iCarossio

[dead]

Hey HN!

I have a lot of questions about how to sanitise and validate GraphQL input so I decided to write a blog post about it with the different techniques :)

Best, Antoine

iCarossio

3 年前議論

Hey HN! I wrote this article will help you make an informed decision.

Feel free to debate and give your point of view ;)

iCarossio

3 年前議論

Yeah you're absolutely right! We couldn't add tags/categories easily for the first version but we are working on it for the future. Thanks for your feedback :)

iCarossio

3 年前議論

Hey, thanks for your feedback. As mentioned, we had to scale up our infra a little due to an unexpected load. It's fixed now ;)

iCarossio

3 年前議論

Hey, thanks for your feedback. Due to an unexpected load, we had to scale up our infra a little. It's fixed now ;)

iCarossio

3 年前議論

For this first version, we assumed you know the API you want to use and want to get some extra info.

The next step could be adding tags/categories so you can look for specific APIs ;)

iCarossio

3 年前議論

Hey coauthor here!

Thanks for your feedback! APIRank is new, and we are eager to make it better.

Please note APIRank we are only compatible with Swagger & OpenAPI specifications. You can propose to index any API you want here: https://apirank.dev/submit

Concerning Github APIs, indeed, we missed it. We will add the following in our next update: https://raw.githubusercontent.com/github/rest-api-descriptio...

iCarossio

3 年前議論

Hey coauthor here.

Thanks for your feedback! APIRank is new, and we are here to improve it and make it useful to the community.

APIRank only considers APIs with an OpenAPI or Swagger specification. It supports any version of Swagger v2+ or OpenAPI v3+.

However, I agree in practice for people, the "design criterium" is not only the compliance to the spec ;)

Antoine

iCarossio

3 年前議論

And as mentioned in the post we filtered soooo many awkward results ^^

iCarossio

3 年前議論

Hey, co-author here! Google does not allow you to browse APIs according to Security, Reliability, not Performance, etc.

Google is not an OpenAPI spec indexer either ;)

iCarossio

3 年前議論

Congratulations for the lunch Second team. :)

iCarossio

3 年前議論

We plan to support authenticated APIs through headers soon. Stay tuned on our Discord https://discord.escape.tech/

iCarossio

3 年前議論

Hope this was the login route haha

iCarossio

3 年前議論

Smart move would be to use Ngrok I guess ;)

iCarossio

3 年前議論

You mean locally?

iCarossio

3 年前議論

Hey folks, co-author here. This is in Beta and there is still a lot of work ahead. We are ready for feedback :)

iCarossio

3 年前議論

Hey ya'll!

Thank you for your feedback on GraphQL.Security https://graphql.security/

Thousands of you wanted us to provide the same free tool for REST OpenAPIs.

At Escape (YC23), we strived to provide the same user experience and quality of results for REST OpenAPIs (and Swagger) as GraphQL APIs.

OpenAPI.Security is still in alpha, and we would love your feedback and ideas!

Best,

Antoine Cofounder & CTO @ Escape.tech

iCarossio

3 年前議論

Hello, the community!

At Escape (WC 23), we released an open-source package (GraphMan) to convert a GraphQL Introspection into a Postman collection automatically. Postman just announced the official collaboration on their website, and we would love your feedback on Graphman!

Best,

Antoine Cofounder & CTO @ https://escape.tech

iCarossio

3 年前議論

Hello everyone :)

Here is a tiny article we wrote at Escape (YC W23) to describe the most common vulnerabilities in GraphQL and how to identify & fix them.

Best, Antoine Cofounder & CTO @ Escape.tech

投稿

How to get into Y Combinator: notes from a W23 alum

Show HN: SecureGPT – The free security tool for ChatGPT Plugin developers

GraphQL Input Validation and Sanitization

Is disabling GraphQL introspection the right move?

Test the security of your REST OpenAPI/Swagger in 10s

Escape API Security (YC W23) Partners with Postman on Open Source (GraphMan)

Escape (YC W23) – The 8 most common GraphQL vulnerabilities you should know

The-Guild.dev x Escape.tech – Make secure GraphQL accessible to everyone

コメント