sc-api-security

API security auditing across REST, GraphQL, and gRPC identifies authentication, authorization, data exposure, and rate-limiting gaps. It enforces OWASP API Security Top 10 checks, including BOLA, broken authentication, and input validation, to detect misconfigurations across multiple API patterns.

Broken object-level authorization (BOLA) is an API security flaw where endpoints fail to validate user access to specific objects. Security audits detect BOLA by evaluating REST, GraphQL, and gRPC endpoints against OWASP API Security Top 10 controls to prevent unauthorized data access.

Checking microservices APIs for excessive data exposure and IDOR involves auditing REST, GraphQL, and gRPC endpoints for property-level authorization gaps. The assessment aligns with OWASP API Security Top 10 to uncover over-exposed fields and broken function-level authorization.

Missing rate limiting and mass assignment vulnerabilities can be detected across REST, GraphQL, and gRPC APIs. The security assessment evaluates these protocols against OWASP API Security Top 10 criteria to identify misconfigurations and input validation gaps.

This API security audit covers security misconfiguration and injection via API parameters. Applied when APIs are detected in the architecture, it evaluates REST, GraphQL, and gRPC endpoints to generate remediation guidance for identified vulnerabilities.