Escape - Application Security & Offensive Security Blog

Competitor Comparison

Escape vs 42Crunch: A Complete Comparison 2025

Today, attackers prioritize exploiting an application's business logic flaws and API vulnerabilities, which may result in the unauthorized extraction of sensitive data. Understanding an application's business logic is challenging, and requires a security platform that comprehends an application's functionalities to address complex API attacks.

API Discovery

What is API discovery, and how does it work?

Ever wondered how applications effortlessly communicate and collaborate, seamlessly sharing data and functionalities? Enter API discovery – the game-changer in modern development. What if finding and connecting with APIs was as intuitive as flipping a switch? As the newly appointed security engineer, you quickly realize the sprawling web of APIs that

AppSec

Application security audit: an in-depth guide

Introduction What are application security audits? In information technologies departments, application security audits are systematic evaluations conducted to assess the security posture of an organization's applications. Application security audits involve finding possible threats and determining the organization's attack surface. The different vectors that attackers can leverage

Announcement

Escape is now SOC 2 Type II compliant

We worked hard to complete the process and get the SOC 2 Type II compliance and finally it's done!

Leveraging Temporal for resilient remote procedure calls (RPC)

Temporal is not the first technology that comes to mind when discussing RPC technologies, but its broad feature set makes it a notable contender in this space.

API Security

Introducing business logic security testing for REST APIs

After one year and a half of approaching API security through the lenses of GraphQL, we are proud to introduce full support for REST API Security Testing in Escape, in addition to GraphQL 🚀 You like us on GraphQL. You will love us on REST. It's been a ride

DevSecOps

How to automate and secure deployment within GitLab CI with Syft and Grype

Ensuring the security of your code is paramount in today's fast-paced development landscape. Thankfully, the automation capabilities of CI/CD pipelines can make this process seamless. In this article, we'll guide you through setting up a GitLab CI pipeline that automates code security checks, allowing you

Announcement

October Spotlight: The major events not to be missed

If you’re not yet convinced that the fall is the best season to attend cybersecurity conferences, our upcoming event lineup might change your mind! This month, we're taking our team global, from the US to Monaco, Canada to Sweden. Are you planning to soak up the sun

Announcement

Escape – The API discovery & security testing platform is now available on AWS Marketplace

With Escape now available on AWS Marketplace, we’re making it easier for all AWS-affiliated organizations to automate the discovery and security testing of all their exposed APIs.

Case Study

Case Study: How Escape enhanced Shine's application security

Shine is the online banking subsidiary of Société Générale, one of the leading financial services groups in Europe. Specifically designed for professionals with a commitment to innovation and customer satisfaction, Shine offers a range of online banking solutions tailored to the modern user. At the heart of Shine's

Case Study

Case Study: How Thinkific has achieved enterprise-grade GraphQL security with Escape

Thinkific, a leading platform for creating and selling online courses, stands out for its commitment to flexibility and innovation. This dedication to innovative technologies led them to embrace GraphQL APIs as the center of their federated architecture. This system would aim to consolidate multiple existing APIs under one branch. However,

DevOps

Why does DevOps recommend "Shift left" principles?

Learn about the shift-left approach in cybersecurity and how it integrates security practices into the early stages of software development.

API

What is an API attack, and how to prevent it?

Explore common API attacks, understand their significant risks, and learn how to prevent them.

API

API Catalog & API Portal: A handbook of everything you should know

Discover the importance of API catalogs, their differences from API portals & gateways, and how to ensure optimal API management and security.

TypeScript

Using Protobuf with TypeScript

We recently moved to Protobuf to enforce consistency. Discover the pros and cons of migration to Protobuf and follow the step-by-step guide to create a tiny TypeScript-Protobuf prototype.

Best Practices

CSRF vs XSS: What is the difference?

Web safety matters. XSS is like sneaky bad notes, while CSRF tricks sites as if it's you. Both misuse website trust. We'll explore how they work and how to protect sites, including using CSRF tokens. Learn about online security with us!

Announcement

How we found a security misconfiguration in Philips' GraphQL API

It is a misconception that discovering vulnerabilities is only within the domain of developers and hackers. Jacob, an Account Executive at Escape, proves this notion wrong. What is a vulnerability disclosure? Vulnerability disclosure is the process of reporting security weaknesses in computer software or hardware. Individuals and groups such as

Announcement

Escape and Xolvio officially partner to help teams secure their GraphQL APIs!

Keeping APIs secure is vital. However, not all organizations have the in-house resources to tackle it effectively. Xolvio's clients can now leverage Escape's expertise in GraphQL security and performance assessments. They can also integrate it into their CI/CD pipelines, enhancing their API security

TypeScript Monorepo

How to set up a TypeScript Monorepo

At Escape, we write our software in TypeScript because it allows us to iterate quickly without compromising on safety. While our codebase evolves a lot as we develop new features, its structure has been stable for a while now. This article aims to explain our current setup, how to put

API Security

OWASP API Security TOP 10 2023: API security checklist

Discover the latest insights into the 2023 OWASP API Security Top 10, as we delve into the most critical vulnerabilities and best practices to protect your APIs.

GraphQL

What are Insecure Direct Object References (IDOR) in GraphQL, and how to fix them

As developers, ensuring the security of our applications is crucial. Insecure Direct Object References (IDOR) are common security vulnerabilities that occur when a system's internal implementation is exposed to users, allowing them to manipulate references to access unauthorized data. GraphQL, a powerful data query and manipulation language for

API Security

API Security Academy: How It Works Under the Hood

The API Security Academy is built upon a technology that comes straight from the future—and by that, we mean the brilliant minds at StackBlitz - WebContainers. You may already know regular containers, the ones you can run with Docker and Kubernetes, which are lightweight virtualization units that allow developers

GraphQL

API Security Academy: a smarter way to learn GraphQL security

Learning about GraphQL security is now more accessible than ever! We're excited to introduce the API Security Academy, developed by the Escape team. Escape's API Security Academy is a free and open-source collection of interactive challenges that will teach you how to secure your GraphQL applications.

Enterprise

What’s new for enterprise - Escape Product Updates

Our enterprise clients, we've got great news for you! During the last months, we worked hard on releasing new product updates to help you improve the efficiency of your business. From Single Sign-On (SSO) to Audit Logs, system status page, and RBAC (Role-Based Access Control), our goal is

Web3 Security

Top 5 Web3 security breaches: A deep dive into DApp frontend and API vulnerabilities

The world is gearing more into a phase of individual ownership of data and digital assets without external interference. This metamorphosis of the web is commonly called Web3. It combines frontend technology, smart contracts, and other components of backend technology, such as indexing, querying, and database management. Smart contracts, a