api

I want to talk about something that sounds boring on the surface but is one of the easiest…

Let me tell you about one of the sneakiest API vulnerabilities out there: Broken Function Level Authorization, or…

I want to explain one of the quietest but most dangerous API bugs out there: Mass Assignment. It’s…

I’ve noticed something over the years of looking at APIs: most breaches don’t come from some genius zero-day…

Injection attacks are some of the oldest tricks in the book — and yet, decades later, they are…

Here’s a question I like to ask teams I work with: “Can you list every single API endpoint…

Out of every vulnerability category I’ve talked about, this one is my favorite to explain, because it’s the…

When I first started digging into API security, rate limiting was one of those things I underestimated. It…

Cloud APIs are a different beast compared to traditional on-premise APIs. When I test an API that’s hosted…

GraphQL changed the way I think about API testing. With REST, I’m usually mapping out dozens of separate…