Escape - Application Security & Offensive Security Blog
Explore practical offensive and application security insights covering web application testing, emerging AI cybersecurity research, API and GraphQL security, and advanced testing techniques.
Filters
Announcement
How we found a security misconfiguration in Philips' GraphQL API
It is a misconception that discovering vulnerabilities is only within the domain of developers and hackers. Jacob, an Account Executive at Escape, proves this notion wrong.
What is a vulnerability disclosure?
Vulnerability disclosure is the process of reporting security weaknesses in computer software or hardware. Individuals and groups such as
3 min read
Announcement
Escape and Xolvio officially partner to help teams secure their GraphQL APIs!
Keeping APIs secure is vital. However, not all organizations have the in-house resources to tackle it effectively. Xolvio's clients can now leverage Escape's expertise in GraphQL security and performance assessments. They can also integrate it into their CI/CD pipelines, enhancing their API security
2 min read
TypeScript Monorepo
How to set up a TypeScript Monorepo
At Escape, we write our software in TypeScript because it allows us to iterate quickly without compromising on safety. While our codebase evolves a lot as we develop new features, its structure has been stable for a while now. This article aims to explain our current setup, how to put
6 min read
GraphQL
What are Insecure Direct Object References (IDOR) in GraphQL, and how to fix them
As developers, ensuring the security of our applications is crucial. Insecure Direct Object References (IDOR) are common security vulnerabilities that occur when a system's internal implementation is exposed to users, allowing them to manipulate references to access unauthorized data. GraphQL, a powerful data query and manipulation language for
8 min read
API Security
API Security Academy: How It Works Under the Hood
The API Security Academy is built upon a technology that comes straight from the future—and by that, we mean the brilliant minds at StackBlitz - WebContainers. You may already know regular containers, the ones you can run with Docker and Kubernetes, which are lightweight virtualization units that allow developers
3 min read
GraphQL
API Security Academy: a smarter way to learn GraphQL security
Learning about GraphQL security is now more accessible than ever! We're excited to introduce the API Security Academy, developed by the Escape team.
Escape's API Security Academy is a free and open-source collection of interactive challenges that will teach you how to secure your GraphQL applications.
3 min read
Enterprise
What’s new for enterprise - Escape Product Updates
Our enterprise clients, we've got great news for you! During the last months, we worked hard on releasing new product updates to help you improve the efficiency of your business. From Single Sign-On (SSO) to Audit Logs, system status page, and RBAC (Role-Based Access Control), our goal is
7 min read
Web3 Security
Top 5 Web3 security breaches: A deep dive into DApp frontend and API vulnerabilities
The world is gearing more into a phase of individual ownership of data and digital assets without external interference. This metamorphosis of the web is commonly called Web3. It combines frontend technology, smart contracts, and other components of backend technology, such as indexing, querying, and database management. Smart contracts, a
9 min read
Announcement
September Spotlight: Where to find us at upcoming events
Staying in touch with the cybersecurity community is super important to us. Good news! We're heading to some exciting events in September.
Get ready for various talks that are packed with insights and solutions. You're going to walk away ready to tackle any API security challenges
4 min read
REST
How to automate API Specifications for Continuous Security Testing (CT)
While GraphQL APIs are growing in popularity due to their flexible query capabilities, REST currently remains the dominant architectural style for building web APIs. Unlike GraphQL, traditional REST technologies do not inherently provide an interactive schema that clients can use to explore the API. At Escape, we decided to use
5 min read
Web3 Security
GraphQL Security: Challenges & Best Practices for DApps
Apart from the issue of poor user experience, security is one of the greatest setbacks to global Web3. Blackhats are constantly exploiting Web3 applications to siphon funds. On the 2nd of July, 2023, Poly Network lost about $5 million to a hack. Atomic Wallet lost over $100 million to a
6 min read
GraphQL
GraphQL Wordlist: Free Open Source for Penetration Testing
In cybersecurity, the old saying that the "best defense is a good offense" rings true. This philosophy is reflected in the approach we call offensive security. It involves actively seeking out system vulnerabilities to fix them before they can be exploited. It's about taking the initiative,
5 min read
GraphQL
Goctopus: Open Source GraphQL Discovery & Fingerprinting
In the fast-evolving domain of APIs, GraphQL has emerged as a powerful, data-oriented language. As its adoption soars, so does the need for robust tools to discover and fingerprint these APIs. Enter Goctopus, a Golang-based solution we developed at Escape to provide comprehensive, fast, and interoperable endpoint discovery and fingerprinting
7 min read
GraphQL Query Cost Analysis
You must have understood that GraphQL is a very powerful language! Indeed, it is the query language used by the world's largest social network: Facebook (they created it in 2012 and made it public in 2015). However, these benefits and power also come with added complexity. This complexity
5 min read
Announcement
Escape raises $3.9 million in seed to secure APIs at every development stage
Official Press release
* Six months after releasing its API security platform, Escape has already secured the applications of 1000+ organizations worldwide and just graduated from Y Combinator.
* The funding will allow the company to hire new team members covering European and US-based customers, aiming to double the team’s size
4 min read
GraphQL
Introducing Seamless GraphQL Compliance
As your go-to partner in GraphQL Security, we at Escape are constantly innovating to simplify and streamline security for you. We're proud of our reputation for crafting modern, dynamic application security testing (DAST) tools tailored to GraphQL, beloved by developers and trusted by security teams worldwide. From comprehensive
3 min read
GraphQL Vulnerability
GraphQL XSS: Cross-Site Scripting Explained
Every Monday morning, you go through your ritual and check the users' feedback. This week, despite all the wonderful feedback, some users are complaining that someone has impersonated them and performed actions on their accounts without their knowledge.
After some investigation, you discover that all the complaining users have
5 min read
GraphQL
GraphQL Input Validation & Sanitization
Why input validation and sanitization are important in GraphQL?
GraphQL allows you to identify the data and validate inputs based on type information. By default, GraphQL Specification has the Int, Float, String, Boolean and ID Scalar types. But as a conscious API developer, you've probably come across situations
5 min read
Say Hi to SecureGPT: The free Security Tool for ChatGPT Developers
👋 tl;dr Are you a ChatGPT plugin developer who wants to ensure the safety and security of your creations? Look no further. Escape is thrilled to announce the release of SecureGPT, a lightning-fast and free security tool designed specifically for ChatGPT plugins. Secure your ChatGPT plugins in seconds with SecureGPT
2 min read
GraphQL
Top 5 GraphQL vulnerabilities burdening HIPAA compliance
TL;DR: GraphQL vulnerabilities will inevitably burden organizations, especially when healthcare compliances like HIPAA come into play. This article highlights how Escape makes it super easy to release compliant APIs.
The correlation between HIPAA and GraphQL is that PHI resources can be exposed through GraphQL APIs, allowing for a more
5 min read
Introducing Escape v2: More Power, More Security, and More Control Over Your GraphQL APIs
tl;dr we are releasing the biggest update of our GraphQL Security platform so far. It includes numerous new features, including API Posture management, Reporting Overview, Better CI/CD Integration, GitHub SSO, and OWASP API Top 10 2023 Support.
Hello, Escape community! We are thrilled to announce the release of
3 min read
GraphQL Vulnerability
Demystifying GraphQL Security: A Comprehensive Guide to GraphQL Introspection
Whether or not to disable introspection in GraphQL has been a common debate among GraphQL developers since its inception. In this blog post, we will explain why completely disabling GraphQL introspection is not necessary and why it can be counterproductive.
I can't really find any good reasons for
5 min read
Don’t let your vulnerabilities escape.
Ready to multiply your force, not just noise?
Book a demo
Book a demo