Topic

#Api Security

13 articles on Api Security — news, releases, guides and analysis from the SourceFeed engine.

Article 1w ago 1

The Security Question Your Scanner Can't Ask

Access control tops OWASP's 2025 list again because authorization is business logic, and no tool audits that for you.

Emeka Okafor

Security Code Fails Silently. Test It Like It Does.

A FastAPI hardening pass shows why exception handlers, logging, and secret sweeps each deserve their own regression tests.

Article · 1w ago5

Stop Treating Your JWT Like a Database

The payload is base64, not ciphertext — and the fix isn't encryption, it's putting less in the token.

Article · 1w ago0

One Parent Path Unlocked 676,000 Connected Trucks

This wasn't car hacking. It was default-allow authorization on a REST API, and no vehicle regulation catches that.

Article · 1mo ago0

676,000 Trucks Behind an API With No Auth

VECV patched in 17 days, but the architecture that made full takeover trivial is everywhere.

Article · 1mo ago5

Build a Secure Express API with Helmet, Zod, and Rate Limiting

Scaffold an Express 5 REST API with security headers, schema validation, and request throttling built in.

Tutorial · 1mo ago0

Issue HMAC-Signed, Scoped API Keys for a Public REST API

Replace static bearer tokens with per-client HMAC request signing, scoped permissions, and replay protection in Node.js.

Tutorial · 1mo ago0

Enforce Fine-Grained Authorization with Open Policy Agent and Rego

Write, test, and serve a real Rego policy for role-based access control, ownership overrides, and data classification, then wire it into a Node middleware layer the way a gateway would.

Tutorial · 1mo ago0

Prompt Injection Is the Least of Your AI Security Problems

Real-world attacks reveal that while frontier models can resist linguistic trickery, your glue code and infrastructure are wide open.

Article · 2mos ago1

The Client-Side Illusion: Lessons from the J&J Web App Vulnerabilities

Relying on frontend SSO flows without backend token validation is a recipe for trivial administrative takeovers.

Article · 2mos ago0

The OAuth Supply Chain: Lessons From the LastPass Breach

A third-party OAuth compromise exposes customer data, highlighting the critical need for strict API token scoping and zero-trust integrations.

Article · 2mos ago4

Cloudflare opens self-service OAuth to every developer

Scoped, revocable delegated access finally replaces pasted API tokens for anyone building on Cloudflare's platform.

Article · 2mos ago4

1,000 Breaches In, and Companies Are Taking Longer Than Ever to Tell You

Troy Hunt's Have I Been Pwned milestone exposes a darkening pattern: breach victims — and the developers who depend on breached services — are flying blind for weeks while data circulates freely on hacking forums.

Article · 2mos ago0