Vulnerability Scanning
API7.ai prioritizes the security of our gateway products. We employ comprehensive security testing and vulnerability scanning throughout the software development lifecycle to identify and address potential threats proactively.
Security Testing Practices
- Static Application Security Testing (SAST): Automated tools scan the API7 Gateway codebase for insecure coding patterns and common vulnerabilities.
- Dynamic Application Security Testing (DAST): We perform runtime analysis of our platform to detect vulnerabilities like injection flaws or configuration errors.
- Dependency Scanning: Continuous monitoring of all open-source dependencies (see Open Source Licenses) for known CVEs.
- Container Image Scanning: All official API7 Gateway container images are scanned for OS-level vulnerabilities before being signed and released.
CVE Reporting and Patching
When a vulnerability is identified, API7.ai follows a structured response process:
- Assessment: The security team evaluates the severity and impact of the vulnerability.
- Patching: We develop and test a security patch to address the vulnerability.
- Release: The patch is released as part of a security update or included in the next version release.
- Advisory: A security advisory is published to notify our customers of the vulnerability and provide guidance on applying the fix.
Vulnerability disclosure policy
We welcome reports from independent security researchers and our community. If you believe you have found a security vulnerability in API7 Gateway, please email security@api7.ai with a detailed description, reproduction steps, and any supporting evidence. Our security team will acknowledge your report and work with you on coordinated disclosure. For general inquiries about our security program or to request additional disclosure channels, contact your API7 support representative.
Third-Party Audits
In addition to our internal testing, API7 Gateway undergoes periodic security audits by reputable third-party security firms. These audits provide an objective assessment of our security posture and help us maintain the highest standards of protection for our enterprise customers.
Next Steps
- Verify Image Signatures to ensure you are running official, scanned images.
- Review our Trust Center for certifications and security reports.