Triage API scan findings in this order: broken authentication and authorization first, then data exposure, then missing limits, then misconfiguration and hygiene. Confirm each finding by hand, record the decision, and fix what is both reachable and sensitive before what is merely noisy.
Start from impact
OWASP's API Top 10 for 2023 gives a useful ordering vocabulary. The first five risks are all about who can do what: object level authorization (API1), authentication (API2), object property level authorization (API3), resource consumption (API4) and function level authorization (API5). Findings that touch these can mean account takeover or data exposure, so they go first.
A triage table
| Priority | Finding type | Why |
|---|---|---|
| 1 | Missing or bypassable authentication | Anyone can call it |
| 1 | Cross user or cross role access | Direct data exposure |
| 2 | Sensitive fields in responses, mass assignment | Data exposure, privilege change |
| 2 | Unsafe handling of tokens | Account takeover path |
| 3 | Missing rate, size and pagination limits | Abuse, cost and outage |
| 4 | Verbose errors, open methods, CORS and header issues | Helps attackers, rarely a breach alone |
| 5 | Informational items | Backlog |
Confirm before you assign
- Reproduce the request by hand.
- Check the context: which role was used, was the environment realistic.
- Check data sensitivity of what is exposed.
- Check reachability from the internet or the relevant network.
- Decide: fix, accept with a reason and expiry, or mark as false positive with a note.
ZAP's API scan notes that by default all alerts are treated as warnings, so a config file is where you tell the tool which rules matter for your build.
Handling false positives
Write the reason, the reviewer and a review date. Suppress at the narrowest scope, for example one rule on one route. Revisit suppressions on a schedule so they do not outlive the code they describe.
Assign and track
Give each confirmed finding an owner, a severity you can defend and a due date. Fix classes of problem, not instances: if one handler lacks an ownership check, search for the same pattern elsewhere.
Re-test
Re-run the same scan after the fix and keep both reports. The pair is useful evidence for buyers and auditors, and it keeps regressions visible.
Try it yourself
Click through it at your own pace, or open it full screen. Look at how findings are grouped, prioritised and tracked to closure.
Quick check
Should I fix every low severity finding?
Not necessarily. Fix cheap ones, batch the rest, and accept the remainder with a written reason and a review date.
Who should own triage?
The team that owns the API should make the call, with security available for severity and exceptions.
Safeguard supports vulnerability management and reachability analysis for dependency findings, and offers a free scan at gold.safeguard.sh/scan.
Sources
Last reviewed: 19 October 2026.
