api-security

Files (1)

• SKILL.md

SKILL.md (first lines)

# api-security

Every endpoint answers: who can call this, on whose objects, with what fields, at what cost.

## Activate when

- Designing, implementing, or reviewing any API; adding endpoints, fields, webhooks, or integrations.

## Do NOT activate for

- Non-API app code (see secure-baseline); identity mechanics (see authentication).

## Inspection

Inventory routes with methods, auth requirements, object scoping, accepted fields, and cost profile (compute, I/O, third-party calls).

## Decision rules

- BOLA first: every object access scoped to the caller; test user-A vs user-B on each endpoint.
- Function-level: role checks on every route including admin/internal ones; no security by obscurity.
- Property-level: mass-assignment allowlists per role; sensitive fields never writable/readable by default.
- Consumption: rate limits + cost caps on expensive endpoints; pagination bounded; no unbounded exports.
- SSRF: no server-side fetches of user URLs without allowlist + no-metadata-IP egress; validate webhooks with signatures.
- Hygiene: security headers, CORS allowlisted, error responses uniform, deprecated versions inventoried and sunset.

## Procedure

1. Threat-list the new surface (spoofing, tampering, repudiation, info disclosure, DoS, elevation) in one pass.
2. Implement authz + validation + limits before business logic; deny by default.
3. Write the attacker tests: cross-user, low-privilege-admin, over-posting, quota-busting, SSRF probe.
4. Verify: attacker matrix green, headers audited, inventory updated, findings mapped to OWASP API Top 10.

## Failure modes

- Auth on most routes but not export/admin/debug ones; client-enforced roles; verbose errors leaking internals; unlimited pagination; SSRF via webhook URLs or image fetches.

## Escalation

Deep auth design → authentication/authorization; full audit → security/secure-baseline.

## References

- Related: `../authentication/`, `../authorization/`, `../validation/`, `../rate-limiting/`, `../../security/secure-baseline/`.

From chnetajibc/skill-repo, MIT.

More from chnetajibc/skill-repo