shieldfy/api-security-checklist

API Security Checklist is a practical, action-oriented reference document for developers and security teams who are building or reviewing web APIs. An API (Application Programming Interface) is how software systems communicate with each other over the internet, and a poorly secured one can expose user data, allow unauthorized access, or enable attacks. The checklist is organized by the lifecycle of an API request, authentication (proving who you are), access controls, input validation, processing, output, and deployment. For each area it lists specific, concrete things to check or implement: for example, always use HTTPS, don't put secret keys in URLs, validate every piece of incoming data, don't return overly detailed error messages that reveal system internals, and make sure debug mode is turned off in production. It also covers cross-cutting concerns like rate limiting (to prevent brute force and denial-of-service attacks), CI/CD pipeline security, monitoring, and more advanced topics like GraphQL-specific risks and secrets management. There is no code to run, it is a documentation checklist. You would use it when designing a new API from scratch to make sure you haven't missed a security concern, when doing a security review of an existing API, or as a training resource for developers who are new to API security. It is available in over 30 languages.