api-security-auditor

Prevent IDOR by verifying resource ownership on every request, comparing the object's userId against the authenticated user before returning data. Additionally, use UUIDv4 or CUID identifiers instead of sequential integers so attackers cannot guess valid object IDs.

Prevent mass assignment by explicitly extracting only allowed fields from req.body instead of passing the whole object to the database. For stronger guarantees, use Zod or Joi schemas with .strict() mode, which rejects requests containing unexpected properties like role or isPaid.

In-memory rate limiting fails in load-balanced environments because each server pod maintains its own counter, giving attackers limit times number-of-pods attempts. Use a centralized Redis store so all pods share one consistent rate limit state.

Yes, API keys should be hashed with SHA-256 before storage, never kept as plaintext. Show the plaintext key only once at creation, and accept keys only via Authorization headers since query parameters leak into server logs and browser history.

Secure GraphQL by enforcing query depth limits to block deeply nested queries, implementing cost analysis with cursor pagination caps, and disabling introspection in production so attackers cannot download your full schema.