A button not being visible in an interface does not mean that action cannot be performed through the API. A secure system protects every endpoint independently of the user interface.
Checklist
- Does authentication really work on every endpoint that needs it?
- Are role and resource ownership checked separately?
- Is input validated by type, length and format?
- Do error messages leak internal system details?
- Are there rate limits and quotas?
- Do secret keys end up in logs?
- Are webhook signatures verified?
- Are API versions and backward behaviour documented?
- Is a smaller payload that carries no sensitive data possible?
- Is there a record to review suspicious requests afterwards?
When should security testing happen?
Instead of testing the API once after it is finished, it is more effective to add automated checks to critical flows with every change. Carry unauthorised access, object-level authorisation and data leakage scenarios into both testing and code review.
Source / further readingWYN working approachThis article does not copy the original content of the source; it is WYN’s practical interpretation. For current headlines, check the publication date and the source page separately.