Escape - Application Security & Offensive Security Blog
Explore practical offensive and application security insights covering web application testing, emerging AI cybersecurity research, API and GraphQL security, and advanced testing techniques.
Filters
Case Study
Case Study: How Escape enhanced Shine's application security
Shine is the online banking subsidiary of Société Générale, one of the leading financial services groups in Europe. Specifically designed for professionals with a commitment to innovation and customer satisfaction, Shine offers a range of online banking solutions tailored to the modern user. At the heart of Shine's
4 min read
Case Study
Case Study: How Thinkific has achieved enterprise-grade GraphQL security with Escape
Thinkific, a leading platform for creating and selling online courses, stands out for its commitment to flexibility and innovation. This dedication to innovative technologies led them to embrace GraphQL APIs as the center of their federated architecture. This system would aim to consolidate multiple existing APIs under one branch. However,
4 min read
Announcement
How we found a security misconfiguration in Philips' GraphQL API
It is a misconception that discovering vulnerabilities is only within the domain of developers and hackers. Jacob, an Account Executive at Escape, proves this notion wrong.
What is a vulnerability disclosure?
Vulnerability disclosure is the process of reporting security weaknesses in computer software or hardware. Individuals and groups such as
3 min read
Announcement
Escape and Xolvio officially partner to help teams secure their GraphQL APIs!
Keeping APIs secure is vital. However, not all organizations have the in-house resources to tackle it effectively. Xolvio's clients can now leverage Escape's expertise in GraphQL security and performance assessments. They can also integrate it into their CI/CD pipelines, enhancing their API security
2 min read
TypeScript Monorepo
How to set up a TypeScript Monorepo
At Escape, we write our software in TypeScript because it allows us to iterate quickly without compromising on safety. While our codebase evolves a lot as we develop new features, its structure has been stable for a while now. This article aims to explain our current setup, how to put
6 min read
GraphQL
What are Insecure Direct Object References (IDOR) in GraphQL, and how to fix them
As developers, ensuring the security of our applications is crucial. Insecure Direct Object References (IDOR) are common security vulnerabilities that occur when a system's internal implementation is exposed to users, allowing them to manipulate references to access unauthorized data. GraphQL, a powerful data query and manipulation language for
8 min read
API Security
API Security Academy: How It Works Under the Hood
The API Security Academy is built upon a technology that comes straight from the future—and by that, we mean the brilliant minds at StackBlitz - WebContainers. You may already know regular containers, the ones you can run with Docker and Kubernetes, which are lightweight virtualization units that allow developers
3 min read
GraphQL
API Security Academy: a smarter way to learn GraphQL security
Learning about GraphQL security is now more accessible than ever! We're excited to introduce the API Security Academy, developed by the Escape team.
Escape's API Security Academy is a free and open-source collection of interactive challenges that will teach you how to secure your GraphQL applications.
3 min read
Enterprise
What’s new for enterprise - Escape Product Updates
Our enterprise clients, we've got great news for you! During the last months, we worked hard on releasing new product updates to help you improve the efficiency of your business. From Single Sign-On (SSO) to Audit Logs, system status page, and RBAC (Role-Based Access Control), our goal is
7 min read
Web3 Security
Top 5 Web3 security breaches: A deep dive into DApp frontend and API vulnerabilities
The world is gearing more into a phase of individual ownership of data and digital assets without external interference. This metamorphosis of the web is commonly called Web3. It combines frontend technology, smart contracts, and other components of backend technology, such as indexing, querying, and database management. Smart contracts, a
9 min read
Announcement
September Spotlight: Where to find us at upcoming events
Staying in touch with the cybersecurity community is super important to us. Good news! We're heading to some exciting events in September.
Get ready for various talks that are packed with insights and solutions. You're going to walk away ready to tackle any API security challenges
4 min read
REST
How to automate API Specifications for Continuous Security Testing (CT)
While GraphQL APIs are growing in popularity due to their flexible query capabilities, REST currently remains the dominant architectural style for building web APIs. Unlike GraphQL, traditional REST technologies do not inherently provide an interactive schema that clients can use to explore the API. At Escape, we decided to use
5 min read
Web3 Security
GraphQL Security: Challenges & Best Practices for DApps
Apart from the issue of poor user experience, security is one of the greatest setbacks to global Web3. Blackhats are constantly exploiting Web3 applications to siphon funds. On the 2nd of July, 2023, Poly Network lost about $5 million to a hack. Atomic Wallet lost over $100 million to a
6 min read
GraphQL
GraphQL Wordlist: Free Open Source for Penetration Testing
In cybersecurity, the old saying that the "best defense is a good offense" rings true. This philosophy is reflected in the approach we call offensive security. It involves actively seeking out system vulnerabilities to fix them before they can be exploited. It's about taking the initiative,
5 min read
GraphQL
Goctopus: Open Source GraphQL Discovery & Fingerprinting
In the fast-evolving domain of APIs, GraphQL has emerged as a powerful, data-oriented language. As its adoption soars, so does the need for robust tools to discover and fingerprint these APIs. Enter Goctopus, a Golang-based solution we developed at Escape to provide comprehensive, fast, and interoperable endpoint discovery and fingerprinting
7 min read
GraphQL Query Cost Analysis
You must have understood that GraphQL is a very powerful language! Indeed, it is the query language used by the world's largest social network: Facebook (they created it in 2012 and made it public in 2015). However, these benefits and power also come with added complexity. This complexity
5 min read
Announcement
Escape raises $3.9 million in seed to secure APIs at every development stage
Official Press release
* Six months after releasing its API security platform, Escape has already secured the applications of 1000+ organizations worldwide and just graduated from Y Combinator.
* The funding will allow the company to hire new team members covering European and US-based customers, aiming to double the team’s size
4 min read
Don’t let your vulnerabilities escape.
Ready to multiply your force, not just noise?
Book a demo
Book a demo