42Crunch is an API security platform that audits OpenAPI specifications for security best practices and performs conformance scanning to verify APIs match their documented specs.

What is 42Crunch?

42Crunch provides a comprehensive API security platform focused on the API definition and implementation lifecycle.

The platform analyzes OpenAPI (Swagger) specifications to identify security issues and tests running APIs for conformance.

The company was founded by API security experts and has become a leader in the API security testing space.

Key Features

API Security Audit

Analyze OpenAPI specifications for security issues:

Authentication scheme analysis
Authorization controls review
Data validation checks
Security header requirements
Rate limiting configurations

API Conformance Scanning

Dynamic testing of running APIs:

Verify API matches OpenAPI spec
Detect undocumented endpoints
Find parameter validation issues
Identify response format discrepancies

Security Score

42Crunch provides an API security score (0-100):

API Security Score: 72/100

Issues Found:
- Critical: 2 (Missing authentication on /admin)
- High: 5 (No rate limiting defined)
- Medium: 12 (Missing input validation)
- Low: 8 (Informational issues)

How It Works

42Crunch operates in two phases:

Design Phase:
OpenAPI Spec → 42Crunch Audit → Security Score + Issues

Runtime Phase:
Live API → Conformance Scan → Spec Violations

Integration

IDE Plugins

Available for popular IDEs:

VS Code extension
IntelliJ IDEA plugin
Eclipse plugin

# VS Code: Install "42Crunch API Security Audit"
# Automatically audits OpenAPI files on save

CI/CD Integration

# GitHub Actions
- name: 42Crunch Security Audit
  uses: 42Crunch/api-security-audit-action@v3
  with:
    api-token: ${{ secrets.API_TOKEN_42CRUNCH }}
    min-score: 75
    fail-on-critical: true

API Integration

# CLI audit
42crunch-cli audit \
  --api-token $TOKEN \
  --spec openapi.yaml \
  --min-score 70

Audit Categories

Category	Description
Authentication	Auth schemes and implementation
Authorization	Access control policies
Transport	HTTPS, TLS configuration
Data Validation	Input/output validation
Error Handling	Error response security
Headers	Security headers (CORS, CSP, etc.)

Conformance Testing

42Crunch tests live APIs for:

Positive Testing

Verify documented functionality:

Correct response codes
Expected response formats
Proper error handling

Negative Testing

Find security gaps:

Missing input validation
Improper error messages
Authentication bypasses
Injection vulnerabilities

OpenAPI Extensions

42Crunch uses custom OpenAPI extensions for security policies:

paths:
  /users:
    get:
      x-42c-local-strategy:
        x-42c-strategy:
          validation:
            request:
              - query
              - headers