42crunch/bitbucket-api-security-audit-pipe repository overview

⁠Bitbucket Pipelines Pipe: 42Crunch REST API Static Security Testing

The REST API Static Security Testing pipe lets you add an automatic static application security testing (SAST) task to your CI/CD pipelines. The pipe checks your OpenAPI files for their quality and security from a simple Git push to your project repository when the CI/CD pipeline runs.

The pipe is powered by 42Crunch API Security Audit⁠. Security Audit performs a static analysis of the API definition that includes more than 200 checks on best practices and potential vulnerabilities on how the API defines authentication, authorization, transport, and data coming in and going out. For more details on the checks, see API Security Encyclopedia⁠.

As a result of the security testing, your APIs get an audit score, with 100 points meaning the most secure, best defined API. By default, the threshold score for the pipe to pass is 75 points for each audited API, but you can change the minimum score in the settings of the pipe.

API contracts must follow the OpenAPI Specification (OAS) (formely Swagger). Both OAS v2 and v3, and both JSON and YAML formats are supported.

You can create a free 42Crunch account at https://platform.42crunch.com/register⁠, and then configure the pipe.

⁠Discover APIs

By default, the pipe locates all OpenAPI files in your project and submits them for static security testing. You can include or exclude specific paths from the discovery phase and can omit the discovery phase completely by adding a pipe configuration file 42c-conf.yaml in the root of your repository and specifying rules for the discovery phase. For more details, see the documentation⁠.

All discovered APIs are uploaded to an API collection in 42Crunch Platform. The pipe uses the environment variables BITBUCKET_REPO_FULL_NAME and BITBUCKET_BRANCH to show the repository and the branch name from where the API collection originated from. During the subsequent pipe runs, the APIs in the collection are kept in sync with the changes in your repository.

⁠Fine-tune the pipe

You can add a task configuration file 42c-conf.yaml in the root of your repository, and to fine-tune the success/failure criteria. For example, you can choose on whether to accept invalid API contracts, or define a cut-off on a certain level of issue severity.

You can define different task configuration for different branches in your repository.

You can specify the full name of the branch (for example, master) or a wildcard (for example, release-*).

For more details, see the documentation⁠.

⁠YAML Definition

Add the following snippet to the script section of your bitbucket-pipelines.yml file:

script:
  - pipe: 42crunch/api-security-audit:2.0.1

⁠Variables

(*) = required variable.

⁠Prerequisites

Create an API token in 42Crunch platform and copy its value into a secured repository variable named SECURED_42C_API_TOKEN.

For more details, see the full documentation⁠.

⁠Examples

Basic example:

script:
  - pipe: 42crunch/api-security-audit:2.0.1

Advanced example:

script:
  - pipe: 42crunch/api-security-audit:2.0.1
    variables:
      MIN_SCORE: "85"
      PLATFORM_URL: "https://platform.42crunch.com"
      LOG_LEVEL: "DEBUG"

⁠Support

The pipe is maintained by [email protected]⁠. If you run into an issue, or have a question not answered here, you can create a support ticket at support.42crunch.com⁠.

If you’re reporting an issue, please include:

• the version of the pipe
• relevant logs and error messages
• steps to reproduce