69 posts
API Security
We have been doing API Security wrong. Discover how the limitations of DAST API security tools might impact your security and why Escape's technology is the best way to protect your APIs.
API Security
We have been doing API Security wrong. Discover how the limitations of traffic-based API security tools might impact your security and why Escape's agentless technology is the best way to protect your APIs.
API Security
Insights from 13,000 GraphQL API issues: Read our deep dive into the current state of GraphQL security.
API Security
Have you ever wondered how automatic specification generation can streamline API security scanning? By significantly reducing the manual effort involved in creating and maintaining API specifications, automated tools offer clear benefits in terms of scan accuracy and setup time. Yet, many existing tools on the market have notable limitations. Understanding these constraints is essential to fully appreciate how Escape's approach to automated spec generation stands out. Code-first tools C
Product updates
We are excited to announce updates to our vulnerability prioritization funnel, which will help you focus on vulnerabilities that pose a real danger to your business.
GraphQL Security
GraphQL APIs, while offering robust features and flexibility, present unique security challenges compared to traditional REST APIs. This article delves into the complexities of securing GraphQL APIs, highlighting common vulnerabilities and providing a comprehensive guide to best practices for building secure GraphQL apps. A visual learner? Check out our latest webinar on GraphQL security: Why Securing GraphQL is Challenging Complex query capabilities GraphQL APIs allow for complex querie
API Security
“DAST is dead” - that’s the phrase that appears every year on social media and in cybersecurity newsletters. But what if in 2024, it finally came true? DAST, Dynamic Application Security Testing (even though we see a new terminology “Dynamic API Security Testing” popping up here and there within the last weeks), has been a cornerstone of application security testing in the last decade but it’s time to make way for the next generation of application security testing - Business Logic Security Tes
Product updates
We are excited to announce the updates to our DAST scanner, helping you achieve improved performance and obtain better results when testing your APIs.
![[Webinar] How to secure GraphQL](/blog/content/images/size/w600/format/webp/2024/04/How-to-secure-GraphQL-webinar-2.png)
API Security
Join Uri Goldshtein and Tristan Kalos for a webinar on GraphQL security and learn to secure your GraphQL APIs.
Custom Security Tests
Welcome to the Elephant in AppSec, the podcast to explore, challenge, and boldly face the AppSec Elephants in the room. In this article, we'll cover the main takeaways from our conversation with Keshav Malik, a senior Product Security Engineer at LinkedIn. Our goal is to help you understand how to better write your custom security tests. Dive right in! Keshav's background Keshav is a Senior Product Security Engineer at LinkedIn. With experience in information security and a passion for autom
API Discovery
Learn more about the concept of API sprawl, its implications, and the challenges and importance of API governance.
![[Fireside Chat] API sprawl: Understanding the growing challenge of 2024 and how to navigate it](/blog/content/images/size/w600/format/webp/2024/03/api-sprawl-how-to-navigate-it--1-.png)
API Security
Hey there 👋 Join Bill Doerrfeld, tech journalist and Editor-in-Chief at the Nordic APIs blog, Erik Wilde, OAI Ambassador at the OpenAPI Initiative, and Antoine Carossio, CTO and co-founder at Escape, for a fireside chat on the challenges of API sprawl. Sign me up! During this live discussion, they will explore: * The key factors contributing to API sprawl * Examine its causes * Discuss its implications for organizations, security engineers, and developers * Share insights on ways to pre
API Security
Organizations are constantly seeking ways to improve their defenses against business logic vulnerabilities. These vulnerabilities, often difficult to detect, can lead to significant security breaches if left unchecked. To address this challenge, we've introduced a new feature within our platform that empowers teams to create custom business logic tests for APIs, enabling the identification and remediation of security flaws at scale. To explain how to get started with custom security tests, we h
API Security
In the last decade, security scanners have evolved to identify common vulnerabilities like SQL injections. But that’s just not enough anymore. In 2024, data leaks in applications come from exploiting business logic flaws. In the next few years, applications will grow in size and number too fast, so the true advantage will come from being able to find business logic vulnerabilities at scale. The growing diversity of security tools changed the way we secured our applications in recent years. Th
Product updates
Today, we’re launching customization improvements to Escape’s automated testing capabilities. With Escape Rules, you can now write custom security tests that do not require any maintenance and adapt to each newly discovered API and each new version of your existing APIs. 💡Want to learn how to write custom security tests for your APIs? Sign up for our upcoming workshop. What is an Escape Rule? Escape Rule is a custom security test that can be created to address unique security concerns or sc
API Security
Do you fully grasp the magnitude of sensitive data exposure? It stands as one of the most prevalent and menacing threats to organizational security in 2025. Picture any information quintessential to an individual's or a company's identity and safety - personal, financial, health, or trade secrets. When such critical data sees the light of day in places it shouldn't, the dominoes start to fall: identity theft, scams, legal battles, tarnished reputations, and steep regulatory penalties. You don't
API Security
Learn about the dangers of API secret key exposure and discover our selection of prevention strategies.
API Security
There are more than 50 new requirements in PCI DSS v4.0 – do you know which ones apply to you and what you need to do to meet them? The March deadline is approaching, and we want to ensure you're fully prepared for the changes ahead. The deadline for compliance in the first phase (with 13 broad new requirements) of PCI DSS 4.0 is March 31, 2024. The implementation deadline for a second phase, comprising requirements of a mostly more technical nature, follows a year later. For the complete lis
API Security
Looking for ways to secure gRPC APIs? Don't worry, we've got you covered! In this article, we will be exploring the topic of gRPC security and its importance in ensuring the security of API endpoints. We will also discuss the role of dynamic application security testing (DAST) tools in securing gRPC APIs and identifying and fixing vulnerabilities before they reach production. What is gRPC? gRPC is a high-performance, open-source RPC (Remote Procedure Call) framework developed by Google.
API Security
Want to know how to secure your applications? You're in the right place. In this article, we will discuss a critical vulnerability that ranks number one in the OWASP API top 10 2023 - Broken Object Level Authorization, also known as BOLA. We will explore the concept of BOLA, its implications, how it can be exploited, and how to secure your applications against it. Authentication vs Authorization Before diving into BOLA, let's clarify the difference between authentication and authorizatio
API Security
Want to know how to secure your APIs built with FastAPI? Dive into our latest blog post, where we guide you through the best practices for FastAPI security.
API Security
Are your API gateways well secured? If you have doubts, then they are not. API gateways play a large role in securing the flow of data between clients and backend services. But with the surge in API adoption (nearly 90% of developers are using APIs) and the increasing sophistication of cyber attacks, ensuring the security of your API gateway is more critical than ever. At the enterprise level, most APIs are deployed using API gateways. For instance, a banking application could leverage an API g
API Security
Want to know how to protect your Laravel applications? Dive into our latest blog post, where we guide you through the best practices for Laravel security. Explore how these techniques can not only enhance the security of your web applications but also bring tangible benefits to your development journey. In this guide, Escape's security research team has gathered the most crucial tips to protect your Laravel applications from potential breaches, focusing on how to implement protection against S
API Security
Hey there! It's just the beginning of the year, but our security research team has been working hard to identify current API security challenges. So for the Escape team, January went under the tagline "API secret sprawl" (we thought it was more fun than"Dry January", and we hope you agree with us 😉). If you're in the security field, you might mention that the beginning of the year usually marks the release of all "State of.. " reports, taking a look at the past year's trends. Instead of coll
