owasp-api-top-10
Safeguard articles tagged "owasp-api-top-10" — guides, analysis, and best practices for software supply chain and application security.
25 articles
The Average Enterprise Runs 900 APIs. It Can List Maybe 600 of Them.
API attacks are climbing steeply and 87% of organisations reported an incident last year. The root cause is not weak authentication — it is that many production endpoints are on nobody's list.
Web API Security: A Practical Guide to Protecting Your APIs
Web API security is about controlling who can call your endpoints, what they can do, and what data they can reach. Here are the risks that matter and the defenses that work.
Broken Object Level Authorization (BOLA/IDOR) in APIs
BOLA/IDOR has topped the OWASP API Security Top 10 since 2019. Here's how USPS, Peloton, and Parler got breached by it—and how to catch it before you do.
Broken Object Property Level Authorization (BOPLA)
BOPLA (OWASP API3:2023) lets APIs correctly check object access while leaking or accepting the wrong fields. Real breaches show why it's so hard to catch.
Unrestricted Resource Consumption in APIs
API4:2023 shows how a single unbounded request—GraphQL depth, a ReDoS regex, an unthrottled upload—can take down an API or run up a cloud bill.
Security Misconfiguration in APIs
Optus, T-Mobile, Peloton, and USPS were all breached through misconfigured APIs, not exploits. Here's what causes it, what it costs, and how to catch it first.
Missing Rate Limiting on APIs and Login Endpoints
Missing rate limiting turned single APIs into 37-million-record breaches at T-Mobile and Optus. Here's why it happens, how attackers exploit it, and how to catch it first.
A practical REST API hardening checklist
OWASP's 2023 API Security Top 10 still ranks broken object-level authorization as the #1 risk — here's a concrete checklist for authn, rate limiting, and input validation.
API security and the rise of shadow/zombie APIs
Shadow and zombie APIs caused breaches at Optus, T-Mobile, and Peloton. Here's why code-scanning tools miss them and what API security best practices actually work.
How an API Security Scanner Works and What to Use
An API security scanner automatically probes your endpoints for authentication, authorization, and injection flaws. Here is how they work and how to fit one into your pipeline.
API Security: A Clear Definition and What It Covers
The API security definition is straightforward: protecting the APIs that expose your data and logic from misuse, abuse, and unauthorized access. What that covers in practice is broader than most teams assume.
How to Run an API Security Scan (and What It Catches)
An API security scan probes your endpoints for auth flaws, broken object-level access, injection, and misconfiguration. Here is how to scan an API properly.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.