API rate limiting: control resource abuse and cost
Design API abuse controls around per-user and tenant limits, request size, concurrency, queues, and expensive integrations, then verify them with safe tests.
Read the guideAPI & identity · 8 guides
Protect access to your application
Practical guides to API authorization, tenant boundaries, sessions, tokens, webhooks, and the identity decisions that protect customer data.
API security testing checklist: identity, data, and cost
Plan API security testing around authentication, object authorization, data exposure, resource limits, webhooks, and safe verification with representative accounts.
Read the guideAuthentication vs authorization: review both boundaries
Understand authentication and authorization through application examples, then review roles, object ownership, privileged actions, and account lifecycle changes.
Read the guideJWT security: validation rules beyond decoding a token
Review JWT signature verification, issuer and audience checks, expiry, key selection, token purpose, and authorization, using practical application examples.
Read the guideOAuth and OIDC security review: redirects, tokens, and access
Review OAuth and OpenID Connect integrations across authorization flow, PKCE, redirect handling, token validation, account linking, and downstream permissions.
Read the guideSaaS tenant isolation: what a security review should test
Review SaaS tenant isolation across APIs, database access, files, caches, background jobs, exports, and support workflows using a practical ownership matrix.
Read the guideSession and cookie security checklist for web apps
Review session creation, cookie settings, renewal, logout, recovery, and role changes, with tests that verify the session lifecycle in a real application.
Read the guideWebhook security: signatures, replay, and safe processing
Secure incoming webhooks with provider signature verification, freshness checks, idempotency, secret rotation, and authorization of the resulting business action.
Read the guide