API Security sampling when tracers lack HTTP routes [Rfc 1076] #10424

jandro996 · 2026-01-22T14:45:58Z

What Does This Do

Implements http.endpoint fallback in the API Security Sampler when http.route is unavailable, enabling sampling of traffic in frameworks that don't provide route information.

Reuses EndpointResolver.computeEndpoint() from RFC-1051 (no code duplication)
Uses static computation method to avoid tagging the span when endpoint is used as fallback
Excludes 404 responses from fallback sampling (failsafe against sampling not-found routes)
Caches computed endpoint with boolean flag to prevent multiple computations per request

Motivation

https://docs.google.com/document/d/1GnWwiaw6dkVtgn5f1wcHJETND_Svqd-sJl6FSVVuCkI/edit?pli=1&tab=t.0

Additional Notes

Contributor Checklist

Format the title according the contribution guidelines
Assign the type: and (comp: or inst:) labels in addition to any useful labels
Don't use close, fix or any linking keywords when referencing an issue.
Use solves instead, and assign the PR milestone to the issue
Update the CODEOWNERS file on source file addition, move, or deletion
Update the public documentation in case of new configuration flag or behavior

Jira ticket: APPSEC-60824

pr-commenter · 2026-01-22T15:36:08Z

Benchmarks

Startup

Parameters

	Baseline	Candidate
baseline_or_candidate	baseline	candidate
git_branch	master	alejandro.gonzalez/rfc-1076
git_commit_date	1769086485	1769169971
git_commit_sha	`3d62379`	`1f3ddc2`
release_version	1.59.0-SNAPSHOT~3d62379c90	1.59.0-SNAPSHOT~1f3ddc2cdb

See matching parameters

	Baseline	Candidate
application	insecure-bank	insecure-bank
ci_job_date	1769171784	1769171784
ci_job_id	1372572507	1372572507
ci_pipeline_id	92451700	92451700
cpu_model	Intel(R) Xeon(R) Platinum 8259CL CPU @ 2.50GHz	Intel(R) Xeon(R) Platinum 8259CL CPU @ 2.50GHz
kernel_version	Linux runner-zfyrx7zua-project-304-concurrent-0-8ik3ypd1 6.8.0-1031-aws #33~22.04.1-Ubuntu SMP Thu Jun 26 14:22:30 UTC 2025 x86_64 x86_64 x86_64 GNU/Linux	Linux runner-zfyrx7zua-project-304-concurrent-0-8ik3ypd1 6.8.0-1031-aws #33~22.04.1-Ubuntu SMP Thu Jun 26 14:22:30 UTC 2025 x86_64 x86_64 x86_64 GNU/Linux
module	Agent	Agent
parent	None	None

Summary

Found 0 performance improvements and 0 performance regressions! Performance is the same for 56 metrics, 9 unstable metrics.

Startup time reports for insecure-bank

gantt
    title insecure-bank - global startup overhead: candidate=1.59.0-SNAPSHOT~1f3ddc2cdb, baseline=1.59.0-SNAPSHOT~3d62379c90

    dateFormat X
    axisFormat %s
section tracing
Agent [baseline] (1.09 s) : 0, 1090299
Total [baseline] (8.781 s) : 0, 8781493
Agent [candidate] (1.094 s) : 0, 1093809
Total [candidate] (8.779 s) : 0, 8778663
section iast
Agent [baseline] (1.231 s) : 0, 1231097
Total [baseline] (9.353 s) : 0, 9353365
Agent [candidate] (1.237 s) : 0, 1237015
Total [candidate] (9.386 s) : 0, 9386357

baseline results

Module	Variant	Duration	Δ tracing
Agent	tracing	1.09 s	-
Agent	iast	1.231 s	140.798 ms (12.9%)
Total	tracing	8.781 s	-
Total	iast	9.353 s	571.873 ms (6.5%)

candidate results

Module	Variant	Duration	Δ tracing
Agent	tracing	1.094 s	-
Agent	iast	1.237 s	143.205 ms (13.1%)
Total	tracing	8.779 s	-
Total	iast	9.386 s	607.694 ms (6.9%)

gantt
    title insecure-bank - break down per module: candidate=1.59.0-SNAPSHOT~1f3ddc2cdb, baseline=1.59.0-SNAPSHOT~3d62379c90

    dateFormat X
    axisFormat %s
section tracing
crashtracking [baseline] (1.179 ms) : 0, 1179
crashtracking [candidate] (1.199 ms) : 0, 1199
BytebuddyAgent [baseline] (653.765 ms) : 0, 653765
BytebuddyAgent [candidate] (656.891 ms) : 0, 656891
GlobalTracer [baseline] (285.63 ms) : 0, 285630
GlobalTracer [candidate] (286.095 ms) : 0, 286095
AppSec [baseline] (32.881 ms) : 0, 32881
AppSec [candidate] (32.867 ms) : 0, 32867
Debugger [baseline] (67.808 ms) : 0, 67808
Debugger [candidate] (67.665 ms) : 0, 67665
Remote Config [baseline] (631.433 µs) : 0, 631
Remote Config [candidate] (605.376 µs) : 0, 605
Telemetry [baseline] (8.923 ms) : 0, 8923
Telemetry [candidate] (8.838 ms) : 0, 8838
Flare Poller [baseline] (3.856 ms) : 0, 3856
Flare Poller [candidate] (3.859 ms) : 0, 3859
section iast
crashtracking [baseline] (1.186 ms) : 0, 1186
crashtracking [candidate] (1.198 ms) : 0, 1198
BytebuddyAgent [baseline] (798.264 ms) : 0, 798264
BytebuddyAgent [candidate] (801.487 ms) : 0, 801487
GlobalTracer [baseline] (257.451 ms) : 0, 257451
GlobalTracer [candidate] (258.944 ms) : 0, 258944
IAST [baseline] (26.805 ms) : 0, 26805
IAST [candidate] (27.2 ms) : 0, 27200
AppSec [baseline] (33.521 ms) : 0, 33521
AppSec [candidate] (34.467 ms) : 0, 34467
Debugger [baseline] (65.86 ms) : 0, 65860
Debugger [candidate] (65.444 ms) : 0, 65444
Remote Config [baseline] (585.462 µs) : 0, 585
Remote Config [candidate] (576.993 µs) : 0, 577
Telemetry [baseline] (8.432 ms) : 0, 8432
Telemetry [candidate] (8.484 ms) : 0, 8484
Flare Poller [baseline] (3.538 ms) : 0, 3538
Flare Poller [candidate] (3.624 ms) : 0, 3624

Startup time reports for petclinic

gantt
    title petclinic - global startup overhead: candidate=1.59.0-SNAPSHOT~1f3ddc2cdb, baseline=1.59.0-SNAPSHOT~3d62379c90

    dateFormat X
    axisFormat %s
section tracing
Agent [baseline] (1.102 s) : 0, 1101754
Total [baseline] (10.862 s) : 0, 10861590
Agent [candidate] (1.088 s) : 0, 1088448
Total [candidate] (10.935 s) : 0, 10934890
section appsec
Agent [baseline] (1.276 s) : 0, 1275638
Total [baseline] (11.038 s) : 0, 11038242
Agent [candidate] (1.284 s) : 0, 1284110
Total [candidate] (11.182 s) : 0, 11182413
section iast
Agent [baseline] (1.235 s) : 0, 1234654
Total [baseline] (11.204 s) : 0, 11203815
Agent [candidate] (1.229 s) : 0, 1229093
Total [candidate] (11.241 s) : 0, 11240828
section profiling
Agent [baseline] (1.206 s) : 0, 1205658
Total [baseline] (10.86 s) : 0, 10860439
Agent [candidate] (1.205 s) : 0, 1205431
Total [candidate] (10.87 s) : 0, 10870424

baseline results

Module	Variant	Duration	Δ tracing
Agent	tracing	1.102 s	-
Agent	appsec	1.276 s	173.884 ms (15.8%)
Agent	iast	1.235 s	132.901 ms (12.1%)
Agent	profiling	1.206 s	103.905 ms (9.4%)
Total	tracing	10.862 s	-
Total	appsec	11.038 s	176.651 ms (1.6%)
Total	iast	11.204 s	342.224 ms (3.2%)
Total	profiling	10.86 s	-1.151 ms (-0.0%)

candidate results

Module	Variant	Duration	Δ tracing
Agent	tracing	1.088 s	-
Agent	appsec	1.284 s	195.662 ms (18.0%)
Agent	iast	1.229 s	140.644 ms (12.9%)
Agent	profiling	1.205 s	116.983 ms (10.7%)
Total	tracing	10.935 s	-
Total	appsec	11.182 s	247.523 ms (2.3%)
Total	iast	11.241 s	305.938 ms (2.8%)
Total	profiling	10.87 s	-64.466 ms (-0.6%)

gantt
    title petclinic - break down per module: candidate=1.59.0-SNAPSHOT~1f3ddc2cdb, baseline=1.59.0-SNAPSHOT~3d62379c90

    dateFormat X
    axisFormat %s
section tracing
crashtracking [baseline] (1.205 ms) : 0, 1205
crashtracking [candidate] (1.185 ms) : 0, 1185
BytebuddyAgent [baseline] (661.556 ms) : 0, 661556
BytebuddyAgent [candidate] (653.209 ms) : 0, 653209
GlobalTracer [baseline] (287.06 ms) : 0, 287060
GlobalTracer [candidate] (284.187 ms) : 0, 284187
AppSec [baseline] (33.213 ms) : 0, 33213
AppSec [candidate] (32.667 ms) : 0, 32667
Debugger [baseline] (69.231 ms) : 0, 69231
Debugger [candidate] (66.551 ms) : 0, 66551
Remote Config [baseline] (628.172 µs) : 0, 628
Remote Config [candidate] (630.146 µs) : 0, 630
Telemetry [baseline] (9.001 ms) : 0, 9001
Telemetry [candidate] (9.801 ms) : 0, 9801
Flare Poller [baseline] (3.875 ms) : 0, 3875
Flare Poller [candidate] (4.657 ms) : 0, 4657
section appsec
crashtracking [baseline] (1.202 ms) : 0, 1202
crashtracking [candidate] (1.201 ms) : 0, 1201
BytebuddyAgent [baseline] (696.477 ms) : 0, 696477
BytebuddyAgent [candidate] (701.219 ms) : 0, 701219
GlobalTracer [baseline] (261.909 ms) : 0, 261909
GlobalTracer [candidate] (263.22 ms) : 0, 263220
IAST [baseline] (24.82 ms) : 0, 24820
IAST [candidate] (25.204 ms) : 0, 25204
AppSec [baseline] (173.779 ms) : 0, 173779
AppSec [candidate] (173.128 ms) : 0, 173128
Debugger [baseline] (67.804 ms) : 0, 67804
Debugger [candidate] (70.226 ms) : 0, 70226
Remote Config [baseline] (791.743 µs) : 0, 792
Remote Config [candidate] (779.587 µs) : 0, 780
Telemetry [baseline] (9.332 ms) : 0, 9332
Telemetry [candidate] (9.505 ms) : 0, 9505
Flare Poller [baseline] (3.719 ms) : 0, 3719
Flare Poller [candidate] (3.795 ms) : 0, 3795
section iast
crashtracking [baseline] (1.195 ms) : 0, 1195
crashtracking [candidate] (1.183 ms) : 0, 1183
BytebuddyAgent [baseline] (799.194 ms) : 0, 799194
BytebuddyAgent [candidate] (794.774 ms) : 0, 794774
GlobalTracer [baseline] (259.061 ms) : 0, 259061
GlobalTracer [candidate] (257.595 ms) : 0, 257595
IAST [baseline] (27.139 ms) : 0, 27139
IAST [candidate] (27.101 ms) : 0, 27101
AppSec [baseline] (33.468 ms) : 0, 33468
AppSec [candidate] (35.129 ms) : 0, 35129
Debugger [baseline] (66.506 ms) : 0, 66506
Debugger [candidate] (65.115 ms) : 0, 65115
Remote Config [baseline] (543.926 µs) : 0, 544
Remote Config [candidate] (610.427 µs) : 0, 610
Telemetry [baseline] (8.408 ms) : 0, 8408
Telemetry [candidate] (8.515 ms) : 0, 8515
Flare Poller [baseline] (3.534 ms) : 0, 3534
Flare Poller [candidate] (3.574 ms) : 0, 3574
section profiling
crashtracking [baseline] (1.212 ms) : 0, 1212
crashtracking [candidate] (1.221 ms) : 0, 1221
BytebuddyAgent [baseline] (701.503 ms) : 0, 701503
BytebuddyAgent [candidate] (701.007 ms) : 0, 701007
GlobalTracer [baseline] (221.955 ms) : 0, 221955
GlobalTracer [candidate] (222.016 ms) : 0, 222016
AppSec [baseline] (32.274 ms) : 0, 32274
AppSec [candidate] (32.31 ms) : 0, 32310
Debugger [baseline] (67.873 ms) : 0, 67873
Debugger [candidate] (68.15 ms) : 0, 68150
Remote Config [baseline] (659.537 µs) : 0, 660
Remote Config [candidate] (696.064 µs) : 0, 696
Telemetry [baseline] (8.947 ms) : 0, 8947
Telemetry [candidate] (8.919 ms) : 0, 8919
Flare Poller [baseline] (3.756 ms) : 0, 3756
Flare Poller [candidate] (3.7 ms) : 0, 3700
ProfilingAgent [baseline] (97.493 ms) : 0, 97493
ProfilingAgent [candidate] (97.431 ms) : 0, 97431
Profiling [baseline] (98.062 ms) : 0, 98062
Profiling [candidate] (98.007 ms) : 0, 98007

Load

Parameters

	Baseline	Candidate
baseline_or_candidate	baseline	candidate
git_branch	master	alejandro.gonzalez/rfc-1076
git_commit_date	1769086485	1769169971
git_commit_sha	`3d62379`	`1f3ddc2`
release_version	1.59.0-SNAPSHOT~3d62379c90	1.59.0-SNAPSHOT~1f3ddc2cdb

See matching parameters

	Baseline	Candidate
application	insecure-bank	insecure-bank
ci_job_date	1769172374	1769172374
ci_job_id	1372572508	1372572508
ci_pipeline_id	92451700	92451700
cpu_model	Intel(R) Xeon(R) Platinum 8259CL CPU @ 2.50GHz	Intel(R) Xeon(R) Platinum 8259CL CPU @ 2.50GHz
kernel_version	Linux runner-zfyrx7zua-project-304-concurrent-0-1njrc4l9 6.8.0-1031-aws #33~22.04.1-Ubuntu SMP Thu Jun 26 14:22:30 UTC 2025 x86_64 x86_64 x86_64 GNU/Linux	Linux runner-zfyrx7zua-project-304-concurrent-0-1njrc4l9 6.8.0-1031-aws #33~22.04.1-Ubuntu SMP Thu Jun 26 14:22:30 UTC 2025 x86_64 x86_64 x86_64 GNU/Linux

Summary

Found 2 performance improvements and 3 performance regressions! Performance is the same for 15 metrics, 16 unstable metrics.

scenario	Δ mean agg_http_req_duration_p50	Δ mean agg_http_req_duration_p95	Δ mean throughput	candidate mean agg_http_req_duration_p50	candidate mean agg_http_req_duration_p95	candidate mean throughput	baseline mean agg_http_req_duration_p50	baseline mean agg_http_req_duration_p95	baseline mean throughput
scenario:load:insecure-bank:iast:high_load	worse [+74.111µs; +166.991µs] or [+3.056%; +6.887%]	unsure [+126.286µs; +570.121µs] or [+1.765%; +7.967%]	unstable [-239.953op/s; +78.703op/s] or [-16.404%; +5.380%]	2.545ms	7.505ms	1382.156op/s	2.425ms	7.156ms	1462.781op/s
scenario:load:insecure-bank:iast_GLOBAL:high_load	worse [+125.316µs; +279.034µs] or [+4.723%; +10.516%]	unsure [+100.400µs; +525.789µs] or [+1.315%; +6.886%]	unstable [-240.405op/s; +59.092op/s] or [-17.702%; +4.351%]	2.856ms	7.949ms	1267.406op/s	2.653ms	7.636ms	1358.062op/s
scenario:load:petclinic:appsec:high_load	better [-1.607ms; -0.940ms] or [-8.171%; -4.782%]	better [-2.641ms; -1.281ms] or [-8.352%; -4.051%]	unstable [-6.546op/s; +37.983op/s] or [-2.800%; +16.247%]	18.389ms	29.664ms	249.500op/s	19.662ms	31.625ms	233.781op/s
scenario:load:petclinic:no_agent:high_load	worse [+1.014ms; +2.266ms] or [+5.922%; +13.235%]	unstable [+1.272ms; +4.442ms] or [+4.417%; +15.424%]	unstable [-50.072op/s; +1.322op/s] or [-18.884%; +0.499%]	18.760ms	31.655ms	240.781op/s	17.120ms	28.798ms	265.156op/s

Request duration reports for insecure-bank

gantt
    title insecure-bank - request duration [CI 0.99] : candidate=1.59.0-SNAPSHOT~1f3ddc2cdb, baseline=1.59.0-SNAPSHOT~3d62379c90
    dateFormat X
    axisFormat %s
section baseline
no_agent (1.17 ms) : 1159, 1182
.   : milestone, 1170,
iast (3.125 ms) : 3084, 3166
.   : milestone, 3125,
iast_FULL (5.699 ms) : 5642, 5755
.   : milestone, 5699,
iast_GLOBAL (3.373 ms) : 3327, 3418
.   : milestone, 3373,
profiling (1.933 ms) : 1918, 1949
.   : milestone, 1933,
tracing (1.796 ms) : 1781, 1810
.   : milestone, 1796,
section candidate
no_agent (1.172 ms) : 1161, 1183
.   : milestone, 1172,
iast (3.312 ms) : 3264, 3360
.   : milestone, 3312,
iast_FULL (5.918 ms) : 5858, 5978
.   : milestone, 5918,
iast_GLOBAL (3.622 ms) : 3560, 3683
.   : milestone, 3622,
profiling (2.017 ms) : 1999, 2035
.   : milestone, 2017,
tracing (1.785 ms) : 1770, 1801
.   : milestone, 1785,

baseline results

Variant	Request duration [CI 0.99]	Δ no_agent
no_agent	1.17 ms [1.159 ms, 1.182 ms]	-
iast	3.125 ms [3.084 ms, 3.166 ms]	1.955 ms (167.0%)
iast_FULL	5.699 ms [5.642 ms, 5.755 ms]	4.528 ms (386.9%)
iast_GLOBAL	3.373 ms [3.327 ms, 3.418 ms]	2.203 ms (188.2%)
profiling	1.933 ms [1.918 ms, 1.949 ms]	762.875 µs (65.2%)
tracing	1.796 ms [1.781 ms, 1.81 ms]	625.496 µs (53.4%)

candidate results

Variant	Request duration [CI 0.99]	Δ no_agent
no_agent	1.172 ms [1.161 ms, 1.183 ms]	-
iast	3.312 ms [3.264 ms, 3.36 ms]	2.14 ms (182.6%)
iast_FULL	5.918 ms [5.858 ms, 5.978 ms]	4.746 ms (404.9%)
iast_GLOBAL	3.622 ms [3.56 ms, 3.683 ms]	2.45 ms (209.0%)
profiling	2.017 ms [1.999 ms, 2.035 ms]	845.267 µs (72.1%)
tracing	1.785 ms [1.77 ms, 1.801 ms]	613.505 µs (52.3%)

Request duration reports for petclinic

gantt
    title petclinic - request duration [CI 0.99] : candidate=1.59.0-SNAPSHOT~1f3ddc2cdb, baseline=1.59.0-SNAPSHOT~3d62379c90
    dateFormat X
    axisFormat %s
section baseline
no_agent (17.594 ms) : 17416, 17771
.   : milestone, 17594,
appsec (19.971 ms) : 19767, 20174
.   : milestone, 19971,
code_origins (18.073 ms) : 17889, 18257
.   : milestone, 18073,
iast (17.967 ms) : 17788, 18146
.   : milestone, 17967,
profiling (19.496 ms) : 19300, 19691
.   : milestone, 19496,
tracing (17.854 ms) : 17677, 18031
.   : milestone, 17854,
section candidate
no_agent (19.387 ms) : 19183, 19590
.   : milestone, 19387,
appsec (18.703 ms) : 18517, 18890
.   : milestone, 18703,
code_origins (17.9 ms) : 17719, 18082
.   : milestone, 17900,
iast (17.893 ms) : 17717, 18069
.   : milestone, 17893,
profiling (19.036 ms) : 18841, 19231
.   : milestone, 19036,
tracing (17.926 ms) : 17749, 18104
.   : milestone, 17926,

baseline results

Variant	Request duration [CI 0.99]	Δ no_agent
no_agent	17.594 ms [17.416 ms, 17.771 ms]	-
appsec	19.971 ms [19.767 ms, 20.174 ms]	2.377 ms (13.5%)
code_origins	18.073 ms [17.889 ms, 18.257 ms]	479.137 µs (2.7%)
iast	17.967 ms [17.788 ms, 18.146 ms]	373.42 µs (2.1%)
profiling	19.496 ms [19.3 ms, 19.691 ms]	1.902 ms (10.8%)
tracing	17.854 ms [17.677 ms, 18.031 ms]	260.524 µs (1.5%)

candidate results

Variant	Request duration [CI 0.99]	Δ no_agent
no_agent	19.387 ms [19.183 ms, 19.59 ms]	-
appsec	18.703 ms [18.517 ms, 18.89 ms]	-683.393 µs (-3.5%)
code_origins	17.9 ms [17.719 ms, 18.082 ms]	-1.486 ms (-7.7%)
iast	17.893 ms [17.717 ms, 18.069 ms]	-1.494 ms (-7.7%)
profiling	19.036 ms [18.841 ms, 19.231 ms]	-350.548 µs (-1.8%)
tracing	17.926 ms [17.749 ms, 18.104 ms]	-1.46 ms (-7.5%)

Dacapo

Parameters

	Baseline	Candidate
baseline_or_candidate	baseline	candidate
git_branch	master	alejandro.gonzalez/rfc-1076
git_commit_date	1769086485	1769169971
git_commit_sha	`3d62379`	`1f3ddc2`
release_version	1.59.0-SNAPSHOT~3d62379c90	1.59.0-SNAPSHOT~1f3ddc2cdb

See matching parameters

	Baseline	Candidate
application	biojava	biojava
ci_job_date	1769172244	1769172244
ci_job_id	1372572509	1372572509
ci_pipeline_id	92451700	92451700
cpu_model	Intel(R) Xeon(R) Platinum 8259CL CPU @ 2.50GHz	Intel(R) Xeon(R) Platinum 8259CL CPU @ 2.50GHz
kernel_version	Linux runner-zfyrx7zua-project-304-concurrent-0-qe1u4vxz 6.8.0-1031-aws #33~22.04.1-Ubuntu SMP Thu Jun 26 14:22:30 UTC 2025 x86_64 x86_64 x86_64 GNU/Linux	Linux runner-zfyrx7zua-project-304-concurrent-0-qe1u4vxz 6.8.0-1031-aws #33~22.04.1-Ubuntu SMP Thu Jun 26 14:22:30 UTC 2025 x86_64 x86_64 x86_64 GNU/Linux

Summary

Found 1 performance improvements and 0 performance regressions! Performance is the same for 10 metrics, 1 unstable metrics.

scenario	Δ mean execution_time	candidate mean execution_time	baseline mean execution_time
scenario:dacapo:tomcat:appsec	better [-1.343ms; -1.004ms] or [-36.769%; -27.505%]	2.478ms	3.652ms

Execution time for tomcat

gantt
    title tomcat - execution time [CI 0.99] : candidate=1.59.0-SNAPSHOT~1f3ddc2cdb, baseline=1.59.0-SNAPSHOT~3d62379c90
    dateFormat X
    axisFormat %s
section baseline
no_agent (1.471 ms) : 1459, 1483
.   : milestone, 1471,
appsec (3.652 ms) : 3436, 3868
.   : milestone, 3652,
iast (2.211 ms) : 2146, 2277
.   : milestone, 2211,
iast_GLOBAL (2.259 ms) : 2192, 2325
.   : milestone, 2259,
profiling (2.487 ms) : 2323, 2651
.   : milestone, 2487,
tracing (2.04 ms) : 1989, 2092
.   : milestone, 2040,
section candidate
no_agent (1.472 ms) : 1460, 1483
.   : milestone, 1472,
appsec (2.478 ms) : 2425, 2531
.   : milestone, 2478,
iast (2.211 ms) : 2146, 2277
.   : milestone, 2211,
iast_GLOBAL (2.26 ms) : 2194, 2326
.   : milestone, 2260,
profiling (2.087 ms) : 2032, 2141
.   : milestone, 2087,
tracing (2.04 ms) : 1988, 2091
.   : milestone, 2040,

baseline results

Variant	Execution Time [CI 0.99]	Δ no_agent
no_agent	1.471 ms [1.459 ms, 1.483 ms]	-
appsec	3.652 ms [3.436 ms, 3.868 ms]	2.181 ms (148.2%)
iast	2.211 ms [2.146 ms, 2.277 ms]	740.423 µs (50.3%)
iast_GLOBAL	2.259 ms [2.192 ms, 2.325 ms]	787.868 µs (53.6%)
profiling	2.487 ms [2.323 ms, 2.651 ms]	1.016 ms (69.1%)
tracing	2.04 ms [1.989 ms, 2.092 ms]	569.399 µs (38.7%)

candidate results

Variant	Execution Time [CI 0.99]	Δ no_agent
no_agent	1.472 ms [1.46 ms, 1.483 ms]	-
appsec	2.478 ms [2.425 ms, 2.531 ms]	1.006 ms (68.4%)
iast	2.211 ms [2.146 ms, 2.277 ms]	739.529 µs (50.2%)
iast_GLOBAL	2.26 ms [2.194 ms, 2.326 ms]	787.856 µs (53.5%)
profiling	2.087 ms [2.032 ms, 2.141 ms]	614.814 µs (41.8%)
tracing	2.04 ms [1.988 ms, 2.091 ms]	567.64 µs (38.6%)

Execution time for biojava

gantt
    title biojava - execution time [CI 0.99] : candidate=1.59.0-SNAPSHOT~1f3ddc2cdb, baseline=1.59.0-SNAPSHOT~3d62379c90
    dateFormat X
    axisFormat %s
section baseline
no_agent (15.521 s) : 15521000, 15521000
.   : milestone, 15521000,
appsec (14.656 s) : 14656000, 14656000
.   : milestone, 14656000,
iast (18.34 s) : 18340000, 18340000
.   : milestone, 18340000,
iast_GLOBAL (17.811 s) : 17811000, 17811000
.   : milestone, 17811000,
profiling (15.092 s) : 15092000, 15092000
.   : milestone, 15092000,
tracing (14.637 s) : 14637000, 14637000
.   : milestone, 14637000,
section candidate
no_agent (15.53 s) : 15530000, 15530000
.   : milestone, 15530000,
appsec (14.55 s) : 14550000, 14550000
.   : milestone, 14550000,
iast (18.376 s) : 18376000, 18376000
.   : milestone, 18376000,
iast_GLOBAL (17.583 s) : 17583000, 17583000
.   : milestone, 17583000,
profiling (15.267 s) : 15267000, 15267000
.   : milestone, 15267000,
tracing (14.744 s) : 14744000, 14744000
.   : milestone, 14744000,

baseline results

Variant	Execution Time [CI 0.99]	Δ no_agent
no_agent	15.521 s [15.521 s, 15.521 s]	-
appsec	14.656 s [14.656 s, 14.656 s]	-865.0 ms (-5.6%)
iast	18.34 s [18.34 s, 18.34 s]	2.819 s (18.2%)
iast_GLOBAL	17.811 s [17.811 s, 17.811 s]	2.29 s (14.8%)
profiling	15.092 s [15.092 s, 15.092 s]	-429.0 ms (-2.8%)
tracing	14.637 s [14.637 s, 14.637 s]	-884.0 ms (-5.7%)

candidate results

Variant	Execution Time [CI 0.99]	Δ no_agent
no_agent	15.53 s [15.53 s, 15.53 s]	-
appsec	14.55 s [14.55 s, 14.55 s]	-980.0 ms (-6.3%)
iast	18.376 s [18.376 s, 18.376 s]	2.846 s (18.3%)
iast_GLOBAL	17.583 s [17.583 s, 17.583 s]	2.053 s (13.2%)
profiling	15.267 s [15.267 s, 15.267 s]	-263.0 ms (-1.7%)
tracing	14.744 s [14.744 s, 14.744 s]	-786.0 ms (-5.1%)

WIP

3f0476c

jandro996 changed the title ~~WIP - Rfc 1076~~ API Security sampling when tracers lack HTTP routes [Rfc 1076] Jan 23, 2026

WIP

1f3ddc2

jandro996 added type: enhancement Enhancements and improvements comp: asm waf Application Security Management (WAF) labels Jan 23, 2026

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

API Security sampling when tracers lack HTTP routes [Rfc 1076] #10424

API Security sampling when tracers lack HTTP routes [Rfc 1076] #10424

jandro996 commented Jan 22, 2026 •

edited by atlassian bot

Loading

Uh oh!

pr-commenter bot commented Jan 22, 2026 •

edited

Loading

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

API Security sampling when tracers lack HTTP routes [Rfc 1076] #10424

Are you sure you want to change the base?

API Security sampling when tracers lack HTTP routes [Rfc 1076] #10424

Conversation

jandro996 commented Jan 22, 2026 • edited by atlassian bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

What Does This Do

Motivation

Additional Notes

Contributor Checklist

Uh oh!

pr-commenter bot commented Jan 22, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Benchmarks

Startup

Parameters

Summary

Load

Parameters

Summary

Dacapo

Parameters

Summary

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

jandro996 commented Jan 22, 2026 •

edited by atlassian bot

Loading

pr-commenter bot commented Jan 22, 2026 •

edited

Loading