Knowledge Base / Application & API Security
Application & API Security
Most breaches begin with an ordinary application flaw: an endpoint that skips an authorization check, a credential committed to a repository, or a workflow that can be abused in a way nobody considered. These problems are preventable when the right checks run early and the design rules are explicit.
The guides in this section cover the OWASP API Security Top 10, business logic vulnerabilities, secrets management, and how to run security scanning in pull requests and GitHub Actions without drowning developers in false positives.
Suggested reading order
- 1The OWASP API Security Top 10 (2023): A Practical Guide
Each of the ten API risks explained with a realistic example and a concrete defense, plus a prioritization guide for small teams.
- 2Business Logic Vulnerabilities: How They Work and How to Prevent Them
Why flaws in workflow rules evade scanners and firewalls, with concrete examples (price tampering, coupon races, step skipping) and server-side patterns that prevent them.
- 3Secrets Management: Preventing and Responding to Hardcoded Credentials
Why secrets leak, how to detect them with scanning and push protection, what to do within the first hour of a leak, and how to design systems that keep secrets out of code.
- 4Automating API Security Linting in CI/CD
What API security linting is, which checks catch real vulnerabilities, how to add it at pre-commit and pull-request stages, and how to keep false positives under control.
- 5Running Security Scanners as a GitHub Action: Setup, Permissions and Pitfalls
A practical guide to running security scanning in GitHub Actions safely: least-privilege tokens, pinning actions to commit SHAs, fork pull request behavior, SARIF reporting and secret handling.
All Application & API Security articles (5)
- 3 min readSecrets Management: Preventing and Responding to Hardcoded CredentialsWhy secrets leak, how to detect them with scanning and push protection, what to do within the first hour of a leak, and how to design systems that keep secrets out of code.
- 3 min readThe OWASP API Security Top 10 (2023): A Practical GuideEach of the ten API risks explained with a realistic example and a concrete defense, plus a prioritization guide for small teams.
- 3 min readAutomating API Security Linting in CI/CDWhat API security linting is, which checks catch real vulnerabilities, how to add it at pre-commit and pull-request stages, and how to keep false positives under control.
- 3 min readBusiness Logic Vulnerabilities: How They Work and How to Prevent ThemWhy flaws in workflow rules evade scanners and firewalls, with concrete examples (price tampering, coupon races, step skipping) and server-side patterns that prevent them.
- 3 min readRunning Security Scanners as a GitHub Action: Setup, Permissions and PitfallsA practical guide to running security scanning in GitHub Actions safely: least-privilege tokens, pinning actions to commit SHAs, fork pull request behavior, SARIF reporting and secret handling.