We help companies create Fast, Secure, and Reliable GraphQL APIs
Hello everyone, we are Antoine and Tristan, the founding team behind Escape.
🧠 Tristan (left) previously worked as a GraphQL Developer and experienced himself the need for better tooling in this ecosystem. 💪 Antoine (right) previously worked as a security engineer for the French Government and Apple 🍎 which led him to the journey of helping developers secure their code.
GraphQL has seen exponential growth in the past years and is now used by 20% of all developers. Companies like Paypal, Walmart, Twitter, and Airbnb are now all relying on GraphQL APIs for their core businesses.
Yet, we observed that most - as in like 95% - of GraphQL APIs that exist today are insanely vulnerable to cyberattacks.
The reason is simple: GraphQL has an entirely different structure than traditional APIs like REST.
Existing security tools do not support it, leaving GraphQL developers and organizations completely blind to the security of what they release and putting their business at risk.
We aimed to build the GraphQL Security Testing tool that devs would love. As developers ourselves, we think such a tool would
Existing tools fail at achieving the latter because they rely on brute-forcing API requests. Thus, most requests are blocked at the validation layer, failing to test the actual code.
At Escape, we developed a new approach called feedback-driven API exploration. We crafted a graph traversal algorithm that learns from the API's responses how to generate requests that actually make sense from a business standpoint.
Requests generated by bruteforce (left) vs. Escape’s feedback-driven exploration (right)
Using this technique, we are able to pass the validation layer and test the code of the application at a deeper level than previous solutions. So far, we have achieved more than 80% coverage in most applications without fine-tuning.
In only 6 months, we partnered with Snyk and Postman, got into the GraphQL foundation, and worked with companies like Neo4j and ArangoDB.
👉 If you are using GraphQL yourself, you are welcome to try our platform and get your application's security report for free, as we unlocked all the features for the YC community: https://app.escape.tech/ycw23!