Escape - The GraphQL Security Blog

tl;dr The Escape Team is excited to announce the release of its latest feature, API Security Posture Management for GraphQL. This feature proposes a single API Catalog view to explore the security, integrity, and performance of all GraphQL operations in one place. You can give it a try for

tl;dr We released OpenAPI.security, an online tool that performs a dozen of security tests on any given OpenAPI/Swagger-based API, with no signup or email required Our team at Escape is mainly focused on securing GraphQL APIs. For this, we developed a new approach called feedback-driven API exploration,

Escape is proud to announce that we are backed by Y Combinator, the world's most prestigious and well-known startup accelerator, joining the YC Winter 23 batch! Y Combinator, known for investing in and mentoring early-stage startups, has an impressive portfolio of successful companies such as Airbnb, Dropbox, and Stripe. A

As our product expands, and so does our team, we need to have a better workflow. By basing themselves on a single source of truth, designers and developers speak the same language, and everyone can then focus on the essential: the user experience. This source of truth is called the

Improve the security of your GraphQL API with Escape and Postman Are you tired of dealing with pesky API vulnerabilities? Want to take your GraphQL game to the next level? Introducing the perfect combo for GraphQL success - Escape and Postman. Escape is a tool that helps developers automatically and

Quickly identify potential DoS, Complexity, N+1 issues, and more.

We recently rebuilt our whole email stack from scratch to improve the developer experience: we now have an instant feedback loop, leveraging a SvelteKit-powered dev server.

Introduction Automating the audit of APIs is a very hard problem: we want to dynamically evaluate those APIs' security, performance, and reliability. But APIs take parameters that are tightly coupled to the underlying business logic. We need a way to know what sequences of requests to send, with what parameters,

After using Vue 2 as our front-end framework for almost two years, it was announced that this support would no longer be maintained, so we decided to migrate to a new framework. But which one to choose: Vue 3 or Svelte? Please note that our goals after the migration were

Welcome back! This article is the second and last part of the Achieving end-to-end type safety in a modern JS GraphQL stack series. Read the first part if you haven't yet! Svelte I won't go into the details of why Svelte, but I like Svelte a lot. It feels great

In this article, we will create a simple GraphQL application, a message board, by combining many recent open-source technologies. This article aims to be a showcase of technologies that work well together rather than a complete tutorial on project setup. It is however a long read, so we decided to

The hardest part when pentesting any system is undoubtedly answering the question: 💡How should we think of that? What is meant is "how outside-the-box thinking works?", and "how is a pentester meant to think outside the box?". Although tackling this question might seem like a near impossible task, but a

A concrete overview of our setup for code quality tools: This highlights how we lint/format code, with a clear focus configuration management through two primary tools: Eslint and Prettier.

Snyk and Escape provide developers with the ability to secure their GraphQL applications during the development lifecycle through an industry-leading end-to-end AppSec approach that includes SAST, DAST, and Cloud Security. SAST and DAST for GraphQL Applications Integrating Escape with Snyk means that a dynamic application security testing tool (DAST) and

If you have ever worked with graphQL, you must know that checking that access control is implemented correctly is a nightmare. Access control is restricting access to a specific resource. In graphQL, you must check that every link (between an object and an object or between a query and an

German on-demand online grocery delivery company Gorillas took the industry by storm, guaranteeing delivery in under 10 minutes and gaining massive popularity throughout the pandemic. Founded in May 2020, Gorillas rapidly spread to dozens of European cities and America. After only three funding rounds, the last of which was in

I have been working on software development for a year, and I noticed that the essential thing in this process is getting results, not the development process itself. During development, developers usually integrate many different technologies into the project. For example, let's say we are developing a graphQL application. The

When thinking of the CI/CD pipeline, you rarely think of security since it is atypical for those pipelines to include security checks. The CI/CD pipeline is where code is written, tested, deployed, and even monitored. All that is possible without giving security a thought, but disregarding security in

Manage your sensitive data in GraphQL applications (PII, passwords, secrets…) We released a new feature in Escape that enables you to detect and fix data leaks with GraphQL. 🚫 The GraphQL Access Control issue, what is it? Access control is the restriction that tells the user who or what can be

Alongside AWS, Microsoft, META, and PayPal, Escape has joined GraphQL Foundation to lend a hand to the GraphQL community in securing their APIs. Two years have passed since Escape members dedicated their work to providing all the necessary tools, support, and information to help the GraphQL community develop the most

Nowadays, whenever you enter a web application, chances are that it uses some API (REST or GraphQL). Why? Simply because APIs are very beneficial and cost-effective, but despite the numerous advantages that APIs bring to the table, there is one disadvantage that to me as a cyber security engineer outweighs