API Security: The Layer Attackers Reach Before Your Interface

Every request that reads or changes a record must confirm that the authenticated user is entitled to that specific record — not merely logged in. This class of flaw is the most common serious issue found in web application testing.

Serialising a whole database row and letting the interface hide fields leaks national identifiers, phone numbers, internal notes and password hashes to anyone reading the network tab.

Limits per IP alone are trivially bypassed. Apply quotas per account and per token, and log authorisation failures — a burst of denied requests from one account is an early breach signal.

Old endpoints kept alive for one legacy mobile app are a standing risk. Keep an inventory of what is exposed, who uses it, and the date it is switched off.