Security is not a feature — it's a foundation. Every production API needs all of these.

1. 1

   Broken Object Level Authorization

   API returns data for IDs it shouldn't. Check ownership on every request.

2. 2

   Broken Authentication

   Weak tokens, no expiry, credential stuffing.

3. 3

   Broken Object Property Level Auth

   Exposing internal fields, mass assignment (set isAdmin=true).

4. 4

   Unrestricted Resource Consumption

   No rate limiting, no payload size limits.

5. 5

   Broken Function Level Authorization

   Admin endpoints accessible to normal users.

6. 6

   Unrestricted Sensitive Flows

   No brute-force protection on login, OTP, password reset.

7. 7

   SSRF

   API fetches URLs from user input — attacker targets internal services.

8. 8

   Security Misconfiguration

   Debug endpoints exposed, verbose errors in prod.

9. 9

   Improper Inventory Management

   Old API versions still live, undocumented endpoints.

10. 10

    Unsafe API Consumption

    Blindly trusting third-party API data without validation.