API Security Checklist

Every API endpoint is an attack surface. Here is the checklist I use for every endpoint I build or review.

Authentication: Is the endpoint authenticated? Is the token validated on every request? Are token expiration and refresh handled correctly?

Authorization: Can users only access their own data? Are role checks enforced server-side? Can a user escalate privileges by modifying request parameters?

Input validation: Are all inputs validated and sanitized? Are SQL injection, XSS, and command injection prevented? Are file uploads scanned and restricted?

Rate limiting: Is the endpoint rate-limited? Can an attacker brute-force credentials or enumerate resources?

Logging: Are security-relevant events logged? Are logs free of sensitive data (passwords, tokens, PII)?