The API security checks we run on every build
Not a survey of every threat that exists — the specific, unglamorous checks that catch most of what we find in real reviews.
Most API breaches we are asked to look at are not clever. They are an endpoint that forgot to check who was asking, a token that never expires, or a debug route that survived to production. The checklist below is boring on purpose.
Authorise on every request, per object
Authentication answers who you are; authorisation answers what this particular record has to do with you. The most common real-world flaw is an endpoint that verifies the token and then trusts an identifier from the request body. If a user can change a number in a URL and see somebody else’s data, nothing else on this list matters.
Validate input at the boundary, with a schema
Every payload gets parsed into a typed shape at the edge, and anything unexpected is rejected there rather than defended against in ten places downstream. This is also what stops mass-assignment: the client cannot set a field simply because the model has one.
Rate limit the things that cost money or leak information
Authentication and password reset, which are where credential stuffing lands.
Search and export endpoints, which are how a slow leak becomes a fast one.
Anything that calls a paid third party on your behalf, including model APIs.
Treat secrets as rotatable from day one
Keys live in the environment, never in the repository, and every one of them has a known way to be rotated without a deploy that takes the service down. We check that the rotation path exists while the project is calm, not during an incident.
Log enough to reconstruct, not enough to leak
Every operation that changes data should be attributable to an actor and a time. Equally, no log line should contain a token, a card number or a full request body from an authenticated session. Both halves of that sentence get checked.
Scan dependencies in CI and actually read the output
An advisory feed that nobody reads is worse than none, because it creates the impression of coverage. We gate merges on it, and we triage what it reports rather than acknowledging it into silence.
Keep reading
How much does an app cost in 2026?
There is no single number, but there is a method. Here is how we turn a rough idea into a range you can plan around, and what makes that range move.
Native or cross-platform: how we actually choose
We default to Flutter for cross-platform work and go native when the project earns it. The decision comes from constraints, not fashion.