Clean core is doing its job: custom logic keeps moving off the ABAP stack. But it does not disappear, it relocates. It lands in the Groovy inside your SAP Integration Suite iFlows and in the Node.js and Java handlers of your CAP side-by-side extensions. Both run real code, and both usually ship with no SAP-aware security review. RedRays now scans both, on the same platform as your ABAP.
1. SAP Integration Suite (CPI): the Groovy nobody scans
As PI/PO reaches the end of mainstream maintenance in 2027, integration moves onto Cloud Integration. A Groovy script step is not a mapping expression, it is application code: it can run OS commands, open sockets, read files and handle credentials. That makes every iFlow a security surface.
RedRays connects to your Integration Suite runtime, pulls the iFlow content and reads each script step. It flags command and code execution, injection, path traversal, XXE, SSRF, hardcoded secrets and sensitive data written to the message log.
Every finding carries a CVSS score, the exact package, artifact and script file, a plain-language explanation and a concrete fix, ready to triage, assign and export.
You register your runtime once, encrypted per tenant. Then you browse your packages and audit a single artifact, a package, or every package in the tenant.
2. CAP and BTP extensions: a different risk model
A CAP application is CDS models plus Node.js or Java handlers plus config such as xs-security.json and mta.yaml. The risks are authorization annotations, service exposure, injection in handlers and over-broad scopes. ABAP tools do not understand it, and generic scanners do not understand it in SAP context.
RedRays reads the whole project in one pass and surfaces the real issues in your BTP app code: tenant isolation gaps, information disclosure, missing CSRF protection, injection and broken authorization.
As with ABAP and CPI, each finding comes with a CVSS score, the exact file and line, and a clear fix. Here, a state-changing POST with no CSRF token, pinned to the controller line.
You can register a Cloud Foundry credential to browse your apps and scan their source, or upload a CAP project ZIP directly. The credential is encrypted at rest and scoped per tenant.
One platform, one findings model
CPI and CAP are not separate tools. Their findings flow through the same console, the same triage workflow and the same PDF and Excel reports as your ABAP scans. One place to look, one process to run.
If your landscape is moving onto Integration Suite or growing CAP extensions, we would like to run this on your own code and show you what it finds.
Related: SAP Integration Suite (CPI) Security Scan and SAP CAP / BTP Extension Security Scan.
