Tech teamRunning a website or small org
Insecure APIs
The behind-the-scenes connections between apps, left under-guarded.
Understand it
APIs are the doors apps and services use to speak to one another. If they do not check identity and permission properly, an attacker can draw out data or trigger actions directly, going around the friendly front end.
How to spot it
On your own systems: APIs with no authentication, weak limits, or returning more data than is needed.
Close the gap
- Authenticate and authorise every API call, on the server.
- Return only the data required - no spare fields.
- Rate-limit to blunt automated abuse.
- Keep an inventory; you cannot protect an API you have forgotten.
What to do about it
This sits with whoever builds and runs your website or systems - it’s beyond what a personal plan should promise to fix. If that’s not you, hand it to whoever looks after your security. We’d rather be honest about where we stop.
Your own accounts and devices are still worth protecting; your plan covers those.