api security

A classic that tests whether you know how hash functions work inside. The scored answer explains length extension, the nested HMAC construction, and how to verify a MAC safely.

API keys identify a caller; OAuth delegates a user's authority. The scored answer picks by who is acting and on whose behalf, and makes API keys as safe as they can be when used.

Scanners rarely find it, because every request looks valid. Finding it at scale is a testing design problem, not a scanning problem.

Work through tenant, role, object and field checks, then extend the review to bulk exports, permission changes and resource budgets with executable acceptance cases.

Verify the sender protocol, persist recoverable intake, distinguish delivery retries from business effects, and work through two offline fixtures and crash boundaries.

GraphQL lets clients ask for exactly what they want, which includes things you did not mean to give them and queries that cost a thousand times a normal one. The scored answer moves controls to where GraphQL actually decides things.

Anything in the app binary belongs to whoever downloads it. The strong answer stops trying to hide a client secret and builds on user tokens, PKCE, device-bound keys and server-side limits.

Moving a secret into C changes who can find it in an afternoon, not whether it can be found. The scored answer shows how an analyst would recover it, then replaces the design with one that does not need a shared secret.

Every layer parses something an attacker wrote, every request costs real money, and tenants share hardware. Walk the path and price each risk.

Use CERT-In’s public advisory to build an evidence-led defense review. Separate the reported campaign from a synthetic response exercise and avoid inventing CVEs, restricted indicators or attribution.

Review caller-controlled options by their actual information, resource and capability effects. Build a bounded product schema instead of forwarding arbitrary configuration.

The service receives customers' source code all day. The scored answer protects that code across tenants, keeps secrets out of prompts and logs, and treats suggestions as untrusted output.

The API is the attack surface and every response is a training example. Prevention is unrealistic; slowing, limiting and noticing are not.

A label is one bit of information per query. A probability vector is a map of the decision boundary, delivered on request.

Define the asset and prohibited use before scoring traffic. Distinguish imitation, partial extraction and credential compromise, and test signals against legitimate workloads.