42Crunch has announced the availability of the 42Crunch API Security Testing Plugin for GitHub Copilot. This latest advance enables developers to continuously audit, test, remediate and validate API security vulnerabilities directly within AI-assisted development workflows.

Organizations are struggling to secure their growing API landscape in the face of increasing attacks, with AI’s heavy reliance on APIs compounding this problem. Consequently, one of the key areas of attention for security and engineering teams is the security testing of these APIs.

According to William Dupre, VP Analyst with Gartner, “building on the testing capabilities in the managing stage, organizations that optimize their API testing capabilities will utilize specifications to further automate API testing. Various API testing tools can use specifications to run functional and security-focused tests against APIs. These efforts will be automated in the build pipeline to provide immediate feedback to development teams on security vulnerabilities in APIs.”

“As agentic workflows become the norm, repository creation, pull request activity, and API usage are all accelerating with no evidence of slowing down. On GitHub alone, commits nearly doubled year over year, crossing 1.4 billion per month, plus over 2 billion GitHub Actions minutes a week,” said GitHub CPO Mario Rodriguez.

“To meet this demand and continue to be the home for all developers (and now their agents), our focus is scaling our underlying systems and improving resilience, security and stability across all of our services, at every layer of the stack,” Rodriguez added.

As reported last year by Veracode, almost half (45%) of AI-generated code contains known OWASP Top 10 vulnerabilities and a survey by security consultancy Upguard revealed that 88% of security leaders admit incorporating unauthorized AI into their daily workflows.

For APIs, the challenge is particularly acute. APIs have become the operational backbone of modern applications, AI agents, and enterprise systems. As developers increasingly rely on AI coding assistants to generate API specifications, integrations, and application logic, manual security reviews risk becoming the very bottleneck that slows enterprise AI adoption.

“The future of software development isn’t simply AI generating more code. It’s AI generating more code that organizations can trust,” said Jacques Declas, CEO of 42Crunch.

“GitHub Copilot and other AI coding assistants are dramatically increasing development velocity, but they are also exposing a fundamental challenge: human security review cannot scale linearly with AI-generated output. Organizations need deterministic security guardrails that can validate, govern, and remediate API security issues at the same speed AI generates them. The 42Crunch API security testing GitHub Copilot plugin delivers exactly that capability,” continued Declas.

The 42Crunch API Security Testing Plugin for GitHub Copilot addresses this challenge by embedding deterministic API security guardrails directly into the development workflow.

The plugin continuously:

• Audits OpenAPI specifications when new APIs are defined
• Detects API security vulnerabilities and governance violations
• Identifies OWASP API Security Top 10 risks
• Provides AI-assisted remediation guidance
• Validates fixes through automated testing
• Enforces organizational API security standards and policies

By automating API security validation, organizations can ensure that security scales alongside AI-assisted development rather than becoming a downstream review process.