Source Intelligence FAQ: Specs, Frameworks, and Source Analysis

Does NightVision require access to our source code? Does NightVision upload any code?

Source Intelligence analyzes source code locally in the NightVision CLI. Source code never leaves your environment. The CLI uploads the generated OpenAPI metadata to NightVision, and to the target you select, including each endpoint’s source file and line number, but not its business logic. With --no-upload, nothing is uploaded. If you explicitly use --dump-code, source snippets are embedded in the OpenAPI document and therefore included in the upload.

How does Source Intelligence differ from traffic-derived API inventories?

Some API security products build an API inventory from collected HTTP traffic. Source Intelligence instead reads the routes declared in source code, which has several advantages:

1. It’s faster. NightVision can generate the OpenAPI spec within a minute. It will take hours or longer for the traffic based approach to generate OpenAPI spec since they need to collect enough representative traffic data.
2. Its coverage is more complete. NightVision’s approach is based on the typical CS formal methods approach and is more complete. The traffic-based approach can be lacking in completeness. They will miss shallow/zombie API endpoints if there is no live traffic against these endpoints (until a catastrophic security breach occurs when someone hits these vulnerable endpoints).
3. It’s cheaper. NightVision’s approach works similarly to a compiler and is very cost-effective. The traffic-based approach needs to ingest and process a large amount of data, which can become very expensive, especially in a cloud environment.
4. It avoids collecting production traffic. Source Intelligence runs locally, so the analysis does not require sending request bodies, credentials, or customer traffic to NightVision.