DEVOPSdigest

StackHawk announced its Deeper API Security Test Coverage release.

This expands StackHawk's solution to help developers scan the entire API layer to uncover potential vulnerabilities.

With this release. StackHawk provides developers the ability to test APIs deeper and faster, so organizations can be confident every build they release is secure.

StackHawk's Deeper API Security Test Coverage release allows teams to leverage existing automated testing tools, such as Postman or Cypress, to guide discovery of the paths and endpoints, provide custom test data to be used during scans and cover proprietary use cases for security testing.

"Modern API and application security requires tooling that integrates into existing engineering workflows and provides thorough test coverage for today's application architectures," said Scott Gerlach, StackHawk co-founder and chief security officer. "With our recent release of Deeper API Security Test features, StackHawk continues to lead the market in depth and accuracy of real API security testing, all while remaining true to our developer-first security approach."

By integrating into existing testing workflows, StackHawk provides developers with security testing in a familiar way, shifting security left.

StackHawk's comprehensive scan functionalities have expanded to address several key issues, including:

- Custom Test Data for REST APIs: The ability to use realistic required variables for paths, query, or request body, is something DAST tools historically have struggled with as the use of incorrectly formatted data can prevent the scan from reaching critical logic in the application.

- Custom Scan Discovery: The ability to use test scripts and data from devtools such as Postman or Cypress for guiding the scanner, resulting in a more comprehensive, thorough test without the need for API docs.

- Custom Test Scripts: The ability to test for specific use cases like business logic, privacy laws, and sensitive data requires custom scripts. This functionality also addresses the issue of tenancy checks, the top vulnerability in the OWASP Top 10, and testing for Broken Function Level
Authorization, which are test cases not covered with the ZAP library.