Neoflex has released NEOMSA APIM 4.6.0, an on-premise API management platform and API Gateway. The main focus of this version is raising the security posture of the product supply chain.
Within the secure development lifecycle (SSDLC), engineers created an SBOM in CycloneDX format, scanned all components and transitive dependencies for known vulnerabilities using Grype, and mapped results to the FSTEC BDU database. After updating vulnerable libraries, the number of registered findings dropped from 57 to 7, with no Critical or High issues remaining in the final build.
Product overview
NEOMSA APIM includes an API Gateway, lifecycle management, authentication and authorization supporting OAuth 2.0, JWT and mTLS, rate limiting, traffic analytics, and a Developer Portal. It works with OpenAPI contracts and deploys on customer infrastructure, including Kubernetes, without sending traffic or metadata to the vendor cloud.
Release verification process
The security check follows a single pipeline:
- Build the release candidate with a frozen set of components.
- Generate the CycloneDX SBOM.
- Scan with Grype against CVE and GHSA databases.
- Map findings to the current FSTEC BDU export and assign severity, risk, and remediation status.
- Apply the Security Gate: the build is blocked until all Critical and High FSTEC BDU entries are resolved.
Medium and Low findings are recorded but do not block release; they are tracked for subsequent dependency updates.
Results
Updates eliminated all 10 Critical and 24 High vulnerabilities. Medium findings fell from 19 to 7, and all 4 Low findings were removed. The final 4.6.0 build contains no Critical or High entries from the FSTEC BDU at the time of the report.
Customers receive a controlled, auditable component list, a consolidated security report, and documented evidence that the product passed a formal security gate before shipment.
