Skip to main content Home Creators agentflocks flocks implementing-api-security-testing-with-42crunch
implementing-api-security-testing-with-42crunch Implement comprehensive API security testing using the 42Crunch platform to perform static audit and dynamic conformance scanning of OpenAPI specifications.
Jump to install Skills Marketplace Discover and explore AI skills built by the community.
Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.
Show prompt details A direct command skips the review prompt. Inspect the source before running it.
npx skills add https://github.com/AgentFlocks/flocks --skill implementing-api-security-testing-with-42crunchThe command stays on one line. Scroll horizontally to inspect it before copying.
Prefer a local copy? Download the files currently available to SkillsMP.
Download Zip Downloading... More from this repository Related occupations SOC
Based on SOC occupation classification
name implementing-api-security-testing-with-42crunch description Implement comprehensive API security testing using the 42Crunch platform to perform static audit and dynamic conformance scanning of OpenAPI specifications. domain cybersecurity subdomain api-security tags ["api-security","42crunch","openapi","api-audit","api-scan","conformance-testing","shift-left","ci-cd-security","owasp-api-top-10"] version 1.0 author mahipal license Apache-2.0 nist_csf ["PR.PS-01","ID.RA-01","PR.DS-10","DE.CM-01"]
Implementing API Security Testing with 42Crunch
Overview
42Crunch is an API security platform that combines Shift-Left security testing with Shield-Right runtime protection. It provides API Audit for static security analysis of OpenAPI definitions, API Conformance Scan for dynamic vulnerability detection, and API Protect for real-time threat prevention. The platform integrates into CI/CD pipelines and IDEs to identify OWASP API Security Top 10 vulnerabilities before and after deployment.
When to Use
When deploying or configuring implementing api security testing with 42crunch capabilities in your environment
When establishing security controls aligned to compliance requirements
When building or improving security architecture for this domain
When conducting security assessments that require this implementation
Prerequisites
42Crunch platform account (free tier available for evaluation)
OpenAPI Specification (OAS) v2.0, v3.0, or v3.1 definitions for target APIs
IDE with 42Crunch extension (VS Code, IntelliJ, or Eclipse)
CI/CD pipeline (Jenkins, GitHub Actions, Azure DevOps, or GitLab CI)
Running API instance for dynamic scanning (conformance scan)
Node.js or Python environment for CLI tooling
Core Concepts
API Audit (Static Analysis)
API Audit performs static security analysis of OpenAPI definitions without requiring a running API. It evaluates the specification against 300+ security checks organized into categories:
Security Score Categories:
Data Validation : Schema definitions, parameter constraints, response validationAuthentication : Security scheme definitions, scope requirementsTransport Security : Server URL schemes, TLS requirementsError Handling : Error response definitions, information leakage prevention
Running API Audit via VS Code Extension:
Install the 42Crunch extension from the VS Code marketplace
Open an OpenAPI specification file (YAML or JSON)
Click the security audit icon in the editor toolbar
Review the security score (0-100) and individual findings
Address issues using the inline remediation guidance
Example OpenAPI Definition with Security Controls:
openapi: 3.0 .3
info:
title:
Secure
User
API
version:
1.0
.0
servers:
-
url:
https://api.example.com/v1
description:
Production
server
(HTTPS
only)
security:
-
BearerAuth:
paths:
/users/{userId}:
get:
operationId:
getUserById
summary:
Retrieve
user
by
ID
parameters:
-
name:
userId
in:
path
required:
true
schema:
type:
string
format:
uuid
pattern:
'^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$'
maxLength:
36
responses:
'200':
description:
User
details
content:
application/json:
schema:
$ref:
'#/components/schemas/User'
'400':
description:
Invalid
request
content:
application/json:
schema:
$ref:
'#/components/schemas/Error'
'401':
description:
Unauthorized
'404':
description:
User
not
found
components:
securitySchemes:
BearerAuth:
type:
http
scheme:
bearer
bearerFormat:
JWT
schemas:
User:
type:
object
required:
-
id
-
email
properties:
id:
type:
string
format:
uuid
readOnly:
true
email:
type:
string
format:
email
maxLength:
254
name:
type:
string
maxLength:
100
pattern:
'^[a-zA-Z\s\-]+$'
additionalProperties:
false
Error:
type:
object
required:
-
code
-
message
properties:
code:
type:
integer
format:
int32
message:
type:
string
maxLength:
256
additionalProperties:
false
API Conformance Scan (Dynamic Testing) The conformance scan dynamically tests a running API against its OpenAPI contract to detect runtime vulnerabilities including OWASP API Security Top 10 issues:
version: "2.0"
scan:
target:
url: https://api.example.com/v1
authentication:
- type: bearer
token: "${API_TOKEN}"
in: header
name: Authorization
settings:
maxScanTime: 3600
requestsPerSecond: 10
followRedirects: false
tests:
owasp:
- bola
- bfla
- injection
- ssrf
- massAssignment
- excessiveDataExposure
Running Conformance Scan via CLI:
npm install -g @42crunch/cicd-cli
42crunch-cli scan \
--api-definition ./openapi.yaml \
--target-url https://api.example.com/v1 \
--token $CRUNCH_TOKEN \
--min-score 70 \
--report-format sarif \
--output scan-report.sarif
CI/CD Pipeline Integration GitHub Actions Integration:
name: API Security Testing
on:
push:
paths:
- 'api/**'
- 'openapi/**'
jobs:
api-security:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- name: 42Crunch API Audit
uses: 42Crunch/api-security-audit-action@v3
with:
api-token: ${{ secrets.CRUNCH_API_TOKEN }}
collection-name: "my-api-collection"
min-score: 75
upload-to-code-scanning: true
- name: 42Crunch Conformance Scan
if: github.ref == 'refs/heads/main'
uses: 42Crunch/api-conformance-scan@v1
with:
api-token: ${{ secrets.CRUNCH_API_TOKEN }}
target-url: ${{ secrets.STAGING_API_URL }}
scan-config: ./42c-conf.yaml
Jenkins Pipeline Integration:
pipeline {
agent any
stages {
stage('API Security Audit') {
steps {
script {
def auditResult = sh(
script: '''
42crunch-cli audit \
--api-definition openapi.yaml \
--token ${CRUNCH_TOKEN} \
--min-score 75 \
--report-format json \
--output audit-report.json
''',
returnStatus: true
)
if (auditResult != 0) {
error("API Security Audit failed - score below threshold")
}
}
}
}
stage('Conformance Scan') {
when { branch 'main' }
steps {
sh '''
42crunch-cli scan \
--api-definition openapi.yaml \
--target-url ${STAGING_URL} \
--token ${CRUNCH_TOKEN} \
--scan-config 42c-conf.yaml
'''
}
}
}
post {
always {
archiveArtifacts artifacts: '*-report.*'
publishHTML([
reportDir: '.',
reportFiles: 'audit-report.html',
reportName: 'API Security Report'
])
}
}
}
API Protect (Runtime Protection) API Protect deploys as a micro-gateway in front of API endpoints to enforce the OpenAPI contract at runtime:
apiVersion: v1
kind: ConfigMap
metadata:
name: api-protect-config
data:
protection-config.json: |
{
"apiDefinition": "/config/openapi.yaml",
"enforcement": {
"validateRequests": true,
"validateResponses": true,
"blockOnFailure": true,
"logLevel": "warn"
},
"rateLimit": {
"enabled": true,
"requestsPerMinute": 100,
"burstSize": 20
},
"allowlist": {
"contentTypes": ["application/json"],
"methods": ["GET", "POST", "PUT", "DELETE"]
}
}
Remediation Workflow When 42Crunch identifies issues, follow this remediation process:
Triage : Review findings sorted by severity (Critical, High, Medium, Low)Analyze : Understand the specific security control missing from the OpenAPI definitionFix : Apply the recommended changes to the specificationValidate : Re-run audit to confirm the score improvementDeploy : Push the updated specification through the CI/CD pipeline Common Audit Findings and Fixes:
Finding Severity Fix No authentication defined Critical Add securitySchemes and security requirements Missing input validation High Add type, format, pattern, maxLength constraints Server URL uses HTTP High Change server URLs to HTTPS No error responses defined Medium Add 4xx and 5xx response definitions additionalProperties not restricted Medium Set additionalProperties: false on object schemas Missing rate limiting Medium Add x-rateLimit extension or use API Protect
Key Security Checks 42Crunch evaluates APIs against these critical security areas:
BOLA Prevention : Validates that object-level authorization patterns are definedBFLA Prevention : Checks for function-level access control definitionsInjection Prevention : Ensures input parameters have proper type/format/pattern constraintsData Exposure : Verifies response schemas limit returned propertiesSecurity Misconfiguration : Checks authentication schemes, transport security, CORS settingsMass Assignment : Validates that request bodies use explicit property allowlists
References 