The API Security Field Guide: 35 Mistakes & Fixes with CodeCrack

The 35 API mistakes behind most breaches, and the fix for each

Most API breaches don't come from clever hackers. They come from everyday mistakes: loading a record without checking who owns it, trusting a role sent by the client, or returning more data than the screen shows.

Every mistake, on one page

• What goes wrong, in plain words
• The risky code you've probably seen in a real codebase
• The fixed code you can copy
• One rule to remember

What's inside

• Authorization: ownership checks, roles, mass assignment, multi-tenant data
• Authentication: JWT verification, token lifetimes, password hashing, rate limits
• Input & injection: SQL, NoSQL, shell commands, file paths, SSRF, uploads
• Browser-facing APIs: CORS, CSRF, XSS, security headers, open redirects
• Abuse & limits: page sizes, timeouts, ReDoS, business-flow abuse
• Secrets & operations: keys in repos, error leaks, logging, forgotten endpoints
• A one-page checklist for code reviews, and a map to the OWASP API Security Top 10 (2023)

Examples use Node.js, but every rule applies to any stack: Python, Java, Go, Elixir or PHP.

How engineers use it

• Reviewing a pull request? Run the one-page checklist on every endpoint it touches.
• Building a new API? Read the group for what you're writing before you ship it.
• Preparing for an interview? 35 concrete answers to "how would you secure this?"

Want the full picture?

Security is one chapter of how real systems are built. The Programming & Software Engineering Handbook covers APIs, databases, concurrency, distributed systems and production in 230 pages, and the Engineer's Bundle adds the 32-page Cheat Sheet Pack. Both are on this page.

Format: 24-page PDF, readable on phone and desktop. Instant download.