StackHawk, the company making application security testing part of software delivery, has announced its Deeper API Security Test Coverage release to help developers scan the entire API layer to uncover potential vulnerabilities. With this release, StackHawk provides developers the ability to test APIs deeper and faster, so organizations can be confident every build they release is secure.

StackHawk’s Deeper API Security Test Coverage release allows teams to leverage existing automated testing tools, such as Postman or Cypress, to guide discovery of the paths and endpoints, provide custom test data to be used during scans and cover proprietary use cases for security testing.

Engineering teams have sophisticated automated test suites in CI/CD to ensure that quality is maintained as they push software changes to production, and security testing should be no different. By integrating into existing testing workflows, StackHawk provides developers with security testing in a familiar way, shifting security left.

StackHawk’s comprehensive scan functionalities have expanded to address several key issues, including:

Custom Test Data for REST APIs: The ability to use realistic required variables for paths, query, or request body, is something DAST tools historically have struggled with as the use of incorrectly formatted data can prevent the scan from reaching critical logic in the application.

Custom Scan Discovery: The ability to use test scripts and data from devtools such as Postman or Cypress for guiding the scanner, resulting in a more comprehensive, thorough test without the need for API docs.

Custom Test Scripts: The ability to test for specific use cases like business logic, privacy laws, and sensitive data requires custom scripts. This functionality also addresses the issue of tenancy checks, the top vulnerability in the OWASP Top 10, and testing for Broken Function Level Authorization, which are test cases not covered with the ZAP library.