Vulnerability Scanning

API7.ai prioritizes the security of its gateway products. API7.ai runs security testing and vulnerability scanning throughout the software development lifecycle to identify and address potential threats proactively.

Security testing practices

• Static Application Security Testing (SAST): Automated tools scan the API7 Gateway codebase for insecure coding patterns and common vulnerabilities.
• Dynamic Application Security Testing (DAST): Runtime analysis of the platform detects vulnerabilities like injection flaws or configuration errors.
• Dependency Scanning: Continuous monitoring of all open-source dependencies (see Open Source Licenses) for known CVEs.
• Container Image Scanning: All official API7 Gateway container images are scanned for OS-level vulnerabilities before being signed and released.

CVE reporting and patching

When a vulnerability is identified, API7.ai follows a structured response process:

1. Assessment: The security team evaluates the severity and impact of the vulnerability.
2. Patching: API7.ai develops and tests a security patch to address the vulnerability.
3. Release: The patch is released as part of a security update or included in the next version release.
4. Advisory: A security advisory is published to notify customers of the vulnerability and provide guidance on applying the fix.

Vulnerability disclosure policy

API7.ai welcomes reports from independent security researchers and from the community. If you believe you have found a security vulnerability in API7 Gateway, email security@api7.ai with a detailed description, reproduction steps, and any supporting evidence. The API7.ai security team will acknowledge your report and work with you on coordinated disclosure. For general inquiries about the security program or to request additional disclosure channels, contact your API7 support representative.

Third-party audits

In addition to the internal testing above, API7 Gateway undergoes periodic security audits by reputable third-party security firms. These audits assess API7.ai's security posture independently.

Next steps

• Verify Image Signatures to ensure you are running official, scanned images.
• Review the Trust Center for certifications and security reports.