Surface Code Discovery

New in APIsec Surface

Find security risks in code and try to exploit them live. Supercharge your APIsec tests.

1. Business logic risks, found in codeMissing auth checks and risky data flows that scanners miss
2. Risks traced to endpointsWhich vulnerable dependencies an attacker can reach
3. Exploited liveAn APIsec scan of the running API confirms or clears each one
4. Fix what's confirmedEach confirmed exploit names the endpoint to fix

Get startedRun the Surface CLIRun in GitHub ActionsRun in Azure PipelinesCover a whole GitHub org

Surface Code Discovery finds the APIs in your source code, registers them as APIsec applications, and keeps them current as the code changes. You don't need an existing OpenAPI specification. It also traces vulnerable dependencies to the endpoints that reach them. APIsec reports each of these as a predicted exploit: a vulnerability the code suggests is reachable, which an APIsec scan of the running API then confirms or clears.

Discovery runs on your own CI runner with the apisec-surface CLI from PyPI. Your source code stays on your runner. APIsec receives only facts and observations about the code, such as routes, called functions, dependency versions, and masked secrets. All further analysis, including AI verification, runs in APIsec on those facts.

What you get

• Each API's endpoints, registered as an application with a published OpenAPI specification.
• Dependency vulnerabilities traced to the endpoints that reach them, as predicted exploits.
• Code-level findings, such as committed secrets, verified by AI analysis in APIsec.

Ways to run

Scope	Guide
One repository, in GitHub Actions	Run Surface Code Discovery in GitHub Actions
One repository, in Azure Pipelines	Run Surface Code Discovery in Azure Pipelines
Every repository in a GitHub organization	Surface Discovery for GitHub
One repository, from your machine	Run the Surface CLI

Each guide needs an APIsec Personal Access Token and your APIsec registration code.

Supported frameworks

Language	Frameworks
Java	Spring Boot, Micronaut, JAX-RS, Servlet. Kotlin source files are not analyzed.
Python	FastAPI, Flask, Django
JavaScript and TypeScript	Express, Fastify, Koa, NestJS, Firebase Cloud Functions
C#	ASP.NET Core, ASP.NET (.NET Framework), gRPC, WCF, Web Forms
Ruby	Rails, Sinatra, Grape, Hanami, Padrino, Roda
Go	Gin

GraphQL APIs are detected in Java, Python, JavaScript, and Ruby.

note

Code Bolt is now Surface Code Discovery, and the Code Bolt GitHub Action is retired. To move a workflow off it, see Migrate from the Code Bolt GitHub Action.

📖 Run the Surface CLI

This guide installs the apisec-surface CLI from PyPI and runs Surface Code Discovery from your own machine. Use it to try Surface on a repository before you add it to CI, or to analyze a repository that has no pipeline. The CLI analyzes the code locally and registers each API it finds as an application in APIsec. Your source code stays on your machine.

📖 Run in GitHub Actions

This guide adds Surface Code Discovery to one GitHub repository. Each push to main registers or updates the repository's APIs in APIsec. It also analyzes the code's dependencies, authentication, and committed secrets. With the settings in this workflow, your source code stays on the GitHub runner; only facts and observations about it reach APIsec.

📖 Run in Azure Pipelines

This guide adds Surface Code Discovery to one repository in Azure DevOps, using an Azure Pipelines YAML pipeline. Each run on main registers or updates the repository's APIs in APIsec. It also analyzes the code's dependencies, authentication, and committed secrets. With the settings in this pipeline, your source code stays on the build agent; only facts and observations about it reach APIsec.

📖 Run on all repos in a GitHub Org

Surface Discovery for GitHub finds the APIs in every repository of a GitHub organization and registers each one as an APIsec application. One repository in your organization runs the APIsec Surface org scan workflow every night. The workflow runs in your organization, on your runners, with your secrets. With the settings in this guide, your source code stays on your runners. APIsec receives only the results of the Surface Code Discovery analysis: facts and observations about the code, such as routes, called functions, dependency versions, and masked secrets.