Section 31 · API & Security
API Design
Audit guide for API versioning, input validation, injection prevention, and gateway configuration.
This guide walks you through auditing a project's API design practices - versioning strategy, input validation, injection prevention, and gateway/proxy configuration.
The Goal: Secure by Design
APIs are your attack surface. This audit ensures your endpoints are hardened against injection attacks and architected for safe, consistent behavior.
- Consistent — APIs use versioning strategies appropriate to their audience (public vs internal)
- Validated — All user input is validated server-side before processing
- Injection-proof — Database queries are protected through parameterized queries or ORM usage
- XSS-safe — User-generated content is properly sanitized before rendering
- Centralized — Authentication, rate limiting, and CORS are handled via gateway or proxy configuration
Before You Start
- Identify API architecture (REST, GraphQL, gRPC, internal vs public)
- Identify backend framework (Express, Fastify, Django, Flask, Go, etc.)
- Check if API is public or internal-only (versioning more important for public)
- Identify database access pattern (ORM vs raw queries)
general
API uses consistent versioning approach (URL or header) or intentionally omits versioning for internal/early-stage APIs
“What breaks when you ship a breaking change today?”
If multiple API versions exist, there is a documented plan for sunsetting old versions with migration guidance
“How many dead API versions are still running in prod?”
All user input is validated on the server using a validation library before processing
“What stops someone from sending you 10MB of garbage as a name field?”
Database queries use ORM methods or parameterized queries - no string concatenation with user input
“Any raw SQL anywhere in this codebase with user input in it?”
User-generated content is escaped or sanitized before rendering to prevent script injection
“Could a user store a script that runs in another user's browser?”
API uses gateway for centralized concerns or has properly configured CORS with whitelisted origins
“Who else's origin can call your API right now?”