API Security Articles

The Latest API Security News, Vulnerabilities & Best Practices

APISecurity.io is a community website for all things related to API security. Our daily news and weekly API Security newsletter cover the latest breaches, vulnerabilities, standards, best practices, regulations, and technology.

API Security Encyclopedia provides details on possible security issues in API contracts and how to remediate them, and our tools help you evaluate how secure the APIs you are working on actually are.

Subscribe to the API Security newsletter

By clicking Subscribe you agree to our Data Policy

From the APISecurity.io Twitter

API Security weekly newsletter issue #85 is out. Main stories by @_nihliphobe, @BillatBroadcom / @aran_api / @DSotnikov / @apiacademy, @michaelisbitski / Frank Catucci / @pragkirk / @Gartner_inc, @epereiralopez
https://t.co/PPVjm0sONr

Google Cloud Deployment Manager fixed API vulnerability found by @epereiralopez. Staging & dogfood versions of the API were accessible and had a flawed fallback to service credentials when user creds failed, and invoked Google internal services via GSLB.
https://t.co/XUONcxYd8c

Solution Path for Forming an API Security Strategy from @Gartner_inc's @michaelisbitski, Frank Catucci & @pragkirk help identify the elements of the API security tooling puzzle. Quick summary: https://t.co/O1rstFsiMJ, full report https://t.co/p4ELQ5HT0c (requires subscription)

The latest episode of @apiacademy is all about API Security: a detailed Q&A with @BillatBroadcom, @aran_api, and @DSotnikov. https://t.co/uBuDXbRbMT

An extremely detailed penetration testing guide for #OAuth 2.0 Code Grant from @_nihliphobe. He provides detailed description and step-by-step testing instructions for each possible vulnerability.
https://t.co/xRUEkEKKsI

From the APISecurity.io Twitter

API Security weekly newsletter issue #85 is out. Main stories by @_nihliphobe, @BillatBroadcom / @aran_api / @DSotnikov / @apiacademy, @michaelisbitski / Frank Catucci / @pragkirk / @Gartner_inc, @epereiralopez
https://t.co/PPVjm0sONr

Google Cloud Deployment Manager fixed API vulnerability found by @epereiralopez. Staging & dogfood versions of the API were accessible and had a flawed fallback to service credentials when user creds failed, and invoked Google internal services via GSLB.
https://t.co/XUONcxYd8c

Solution Path for Forming an API Security Strategy from @Gartner_inc's @michaelisbitski, Frank Catucci & @pragkirk help identify the elements of the API security tooling puzzle. Quick summary: https://t.co/O1rstFsiMJ, full report https://t.co/p4ELQ5HT0c (requires subscription)

The latest episode of @apiacademy is all about API Security: a detailed Q&A with @BillatBroadcom, @aran_api, and @DSotnikov. https://t.co/uBuDXbRbMT

An extremely detailed penetration testing guide for #OAuth 2.0 Code Grant from @_nihliphobe. He provides detailed description and step-by-step testing instructions for each possible vulnerability.
https://t.co/xRUEkEKKsI