skills.rest
snoodleboot-io
snoodleboot-ioOFFICIAL
Explore all skills by this author →
GitHub

api-security

Reviews API implementations for authorization, injection, and SSRF vulnerabilities.

Updated Dec 29, 2025
Search Tags:#code review#authorization#input validation#owasp#row-level security#api security#ssrf
One-click install
npx skills add https://github.com/snoodleboot-io/discrecontinual_equations --skill api-security-snoodleboot-io
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: api-security
Source: https://github.com/snoodleboot-io/discrecontinual_equations/tree/main/.claude/skills/api-security
Command: npx skills add https://github.com/snoodleboot-io/discrecontinual_equations --skill api-security-snoodleboot-io

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? APIs expose every identifier and endpoint directly to clients, making broken object-level authorization, mass assignment, SSRF, and information leakage the dominant vulnerability classes. This Skill provides concrete patterns and checklists to find and fix these flaws before attackers do. ## Core Features & Use Cases - Object-Level Authorization: Enforces tenant scoping inside queries and via Postgres row-level security so cross-tenant reads become structurally impossible. - Input & SSRF Hardening: Strict request schemas with extra-field rejection, plus egress controls that block DNS rebinding and cloud metadata access. - Response & Inventory Hygiene: Explicit response schemas, correlation-id error handling, and CI checks that diff live routes against the OpenAPI spec. - Use Case: Before shipping a multi-tenant SaaS endpoint, run the checklist to verify every query is tenant-scoped, 404s hide existence, and deprecated routes have sunset dates. ## Quick Start Review my FastAPI invoice endpoint for broken object-level authorization and SSRF risks using the api-security checklist.

Frequently Asked Questions about api-security

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I prevent broken object-level authorization in APIs?▼

Make tenant or owner scope part of the database query itself rather than a check after fetching. Use a repository layer that only exposes tenant-scoped lookups, or enforce Postgres row-level security so every query inherits the boundary.

How to prevent SSRF in webhook and URL import features?▼

Resolve the hostname and block private, loopback, and link-local address ranges before connecting. Pin the resolved address into the connection, re-validate every redirect hop, and route egress through an allowlisting proxy to defeat DNS rebinding.

Should APIs return 403 or 404 for unauthorized resources?▼

Return 404 for any object the caller may not see. A 403 confirms the resource exists, giving attackers a free enumeration oracle; not-authorized and not-found must be indistinguishable.

Does row-level security replace application authorization checks?▼

Row-level security enforces tenant isolation at the database, covering ORM bugs and ad-hoc queries, but you still need function-level checks for admin and bulk endpoints. Remember WITH CHECK governs writes while USING governs reads.

Why is binding request bodies directly to ORM models dangerous?▼

Direct binding enables mass assignment, letting clients set fields like role or balance. Use a separate input schema with unknown fields rejected, plus an explicit output schema so internal fields never leak into responses.

Related Skills

Explore More Software Engineering Skills→
NUMU-IONUMU-IO
2

speckit-security-review-plan

Review Spec-Kit planning artifacts for security weaknesses before implementation.

Official
Intermediate
marcboggsmarcboggs

hunt-shadow-api

Enumerate API version history and behaviorally diff old versus current endpoints for security regressions.

Community
Intermediate
srnicholssrnichols
5

security-audit

Audit Go projects for vulnerabilities, dependencies, secrets, and report findings.

Community
Advanced
hung-phanhung-phan

sidecar

Implement the Sidecar pattern for mTLS, retries, and logging in microservices.

Community
Advanced