#APISecurity

Tanya Janca | SheHacksPurple :verified: :verified:🎥 Missed one of my past conference talks? Let’s fix that.I’m sharing my favorites—packed with real-world advice, lessons, and a few laughs.“Top Ten Security Tips for APIs” 📽️ <a href="https://twp.ai/4ioX6N" rel="nofollow noopener" translate="no" target="_blank">https://twp.ai/4ioX6N</a><a href="https://infosec.exchange/tags/CyberSecurity" class="mention hashtag" rel="nofollow noopener" target="_blank">#CyberSecurity</a> <a href="https://infosec.exchange/tags/SecurityAwareness" class="mention hashtag" rel="nofollow noopener" target="_blank">#SecurityAwareness</a> <a href="https://infosec.exchange/tags/appsec" class="mention hashtag" rel="nofollow noopener" target="_blank">#appsec</a> <a href="https://infosec.exchange/tags/APISecurity" class="mention hashtag" rel="nofollow noopener" target="_blank">#APISecurity</a>

Nicola :official_verified:What would you do if you discovered a <a href="https://infosec.exchange/tags/bug" class="mention hashtag" rel="nofollow noopener" target="_blank">#bug</a> or <a href="https://infosec.exchange/tags/loophole" class="mention hashtag" rel="nofollow noopener" target="_blank">#loophole</a> that provided free lifetime service instead of the usual annual or monthly fees? I've been trying to reach out to the company for a year, sending emails and requesting contact with their <a href="https://infosec.exchange/tags/development" class="mention hashtag" rel="nofollow noopener" target="_blank">#development</a> or <a href="https://infosec.exchange/tags/security" class="mention hashtag" rel="nofollow noopener" target="_blank">#security</a> team, but I haven't received a response.The <a href="https://infosec.exchange/tags/CEO" class="mention hashtag" rel="nofollow noopener" target="_blank">#CEO</a> is active on <a href="https://infosec.exchange/tags/X" class="mention hashtag" rel="nofollow noopener" target="_blank">#X</a> and <a href="https://infosec.exchange/tags/Meta" class="mention hashtag" rel="nofollow noopener" target="_blank">#Meta</a>, but I don't have accounts on those platforms but I can't contact him directly anyway since DMs are disabled. Any suggestions?The service still works after a year of using it.<a href="https://infosec.exchange/tags/hacking" class="mention hashtag" rel="nofollow noopener" target="_blank">#hacking</a> <a href="https://infosec.exchange/tags/api" class="mention hashtag" rel="nofollow noopener" target="_blank">#api</a> <a href="https://infosec.exchange/tags/apisecurity" class="mention hashtag" rel="nofollow noopener" target="_blank">#apisecurity</a>

OWASP FoundationJoin Tanya Janca on November 5 for a 1-day, hands-on training session at OWASP Global AppSec USA 2025 and learn how to design and harden APIs the right way.Secure your training spot now: <a href="https://owasp.glueup.com/event/131624/register/" rel="nofollow noopener" translate="no" target="_blank">https://owasp.glueup.com/event/131624/register/</a><a href="https://infosec.exchange/tags/GlobalAppSecUS" class="mention hashtag" rel="nofollow noopener" target="_blank">#GlobalAppSecUS</a> <a href="https://infosec.exchange/tags/Cybersecurity" class="mention hashtag" rel="nofollow noopener" target="_blank">#Cybersecurity</a> <a href="https://infosec.exchange/tags/CyberSec" class="mention hashtag" rel="nofollow noopener" target="_blank">#CyberSec</a> <a href="https://infosec.exchange/tags/ThreatModeling" class="mention hashtag" rel="nofollow noopener" target="_blank">#ThreatModeling</a> <a href="https://infosec.exchange/tags/DevSecOps" class="mention hashtag" rel="nofollow noopener" target="_blank">#DevSecOps</a> <a href="https://infosec.exchange/tags/AI" class="mention hashtag" rel="nofollow noopener" target="_blank">#AI</a> <a href="https://infosec.exchange/tags/Hacking" class="mention hashtag" rel="nofollow noopener" target="_blank">#Hacking</a> <a href="https://infosec.exchange/tags/WashingtonDC" class="mention hashtag" rel="nofollow noopener" target="_blank">#WashingtonDC</a> <a href="https://infosec.exchange/tags/AppSec" class="mention hashtag" rel="nofollow noopener" target="_blank">#AppSec</a> <a href="https://infosec.exchange/tags/APISecurity" class="mention hashtag" rel="nofollow noopener" target="_blank">#APISecurity</a> <a href="https://infosec.exchange/tags/SecureCode" class="mention hashtag" rel="nofollow noopener" target="_blank">#SecureCode</a> <a href="https://infosec.exchange/tags/API" class="mention hashtag" rel="nofollow noopener" target="_blank">#API</a>

Sam Stepanyan :verified: 🐘<a href="https://infosec.exchange/tags/JWT" class="mention hashtag" rel="nofollow noopener" target="_blank">#JWT</a>: 'Attacking JWT using X509 Certificates': how an attacker could sign the JWT token with their own private key and modify the header value to specify their public key for signature verification: <a href="https://infosec.exchange/tags/AppSec" class="mention hashtag" rel="nofollow noopener" target="_blank">#AppSec</a> <a href="https://infosec.exchange/tags/APIsecurity" class="mention hashtag" rel="nofollow noopener" target="_blank">#APIsecurity</a><a href="https://trustedsec.com/blog/attacking-jwt-using-x509-certificates" rel="nofollow noopener" translate="no" target="_blank">https://trustedsec.com/blog/attacking-jwt-using-x509-certificates</a>

Marco Ciappelli🎙️✨:verified: :donor:🚀 New Brand Story from <a href="https://infosec.exchange/tags/RSAC2025" class="mention hashtag" rel="nofollow noopener" target="_blank">#RSAC2025</a>: Runtime Protection at the New Digital Front LineAt <a href="https://infosec.exchange/tags/RSAC" class="mention hashtag" rel="nofollow noopener" target="_blank">#RSAC</a> Conference 2025, Sean Martin, CISSP sat down with Rupesh Chokshi, Senior Vice President and GM of Application Security at Akamai Technologies, to talk about how AI-driven applications and <a href="https://infosec.exchange/tags/APIs" class="mention hashtag" rel="nofollow noopener" target="_blank">#APIs</a> are reshaping the security landscape.🔐 Why are runtime attacks on APIs and <a href="https://infosec.exchange/tags/AI" class="mention hashtag" rel="nofollow noopener" target="_blank">#AI</a> apps growing—and why is prevention alone no longer enough?Find out how Akamai is evolving its Web Application and API Protection (<a href="https://infosec.exchange/tags/WAAP" class="mention hashtag" rel="nofollow noopener" target="_blank">#WAAP</a>) strategies to meet these emerging threats head-on.🎙️ Watch, listen, or read the full story here: 👉 <a href="https://www.itspmagazine.com/their-stories/the-new-front-line-runtime-protection-for-ai-and-api-driven-attacks-a-brand-story-with-rupesh-chokshi-from-akamai-an-on-location-rsac-conference-2025-brand-story" rel="nofollow noopener" translate="no" target="_blank">https://www.itspmagazine.com/their-stories/the-new-front-line-runtime-protection-for-ai-and-api-driven-attacks-a-brand-story-with-rupesh-chokshi-from-akamai-an-on-location-rsac-conference-2025-brand-story</a><a href="https://infosec.exchange/tags/cybersecurity" class="mention hashtag" rel="nofollow noopener" target="_blank">#cybersecurity</a> <a href="https://infosec.exchange/tags/infosec" class="mention hashtag" rel="nofollow noopener" target="_blank">#infosec</a> <a href="https://infosec.exchange/tags/appsec" class="mention hashtag" rel="nofollow noopener" target="_blank">#appsec</a> <a href="https://infosec.exchange/tags/apisecurity" class="mention hashtag" rel="nofollow noopener" target="_blank">#apisecurity</a> <a href="https://infosec.exchange/tags/technology" class="mention hashtag" rel="nofollow noopener" target="_blank">#technology</a> <a href="https://infosec.exchange/tags/infosecurity" class="mention hashtag" rel="nofollow noopener" target="_blank">#infosecurity</a>

Marco Ciappelli🎙️✨:verified: :donor:🌐 The Digital Terrain Is Shifting — Are Your Apps and APIs Ready?As AI adoption accelerates, so do AI-driven attacks. In their new research report, Akamai Technologies uncovers the evolving threats facing web applications and APIs — and how organizations can respond before attackers get ahead.State of Apps and API Security 2025: How <a href="https://infosec.exchange/tags/AI" class="mention hashtag" rel="nofollow noopener" target="_blank">#AI</a> Is Shifting the Digital Terrain explores the sharp rise in automated, intelligent threats — and the new defenses emerging to meet them.📥 Download the full report here: <a href="https://itspm.ag/akamaixmwd" rel="nofollow noopener" translate="no" target="_blank">https://itspm.ag/akamaixmwd</a> 📌 Research like this helps <a href="https://infosec.exchange/tags/security" class="mention hashtag" rel="nofollow noopener" target="_blank">#security</a> professionals, <a href="https://infosec.exchange/tags/leaders" class="mention hashtag" rel="nofollow noopener" target="_blank">#leaders</a>, and <a href="https://infosec.exchange/tags/developers" class="mention hashtag" rel="nofollow noopener" target="_blank">#developers</a> stay ahead of the curve — and shape the future of <a href="https://infosec.exchange/tags/digital" class="mention hashtag" rel="nofollow noopener" target="_blank">#digital</a> defense.🎙️ We’re also proud to feature Akamai in our RSAC 2025 coverage — with a Brand Story recorded pre-event and a follow-up conversation happening on location at the conference in San Francisco with Rupesh Chokshi, Sean Martin, CISSP, and Marco Ciappelli.Watch the pre-event recording here: <a href="https://youtu.be/DMm6INJ_2Z8" rel="nofollow noopener" translate="no" target="_blank">https://youtu.be/DMm6INJ_2Z8</a> 🙏 A huge thank you to the Akamai team for sponsoring our coverage and sharing their insights with our global audience.👇 Check out the report and stay tuned for more from RSAC:📥 Download the Report: <a href="https://itspm.ag/akamaixmwd" rel="nofollow noopener" translate="no" target="_blank">https://itspm.ag/akamaixmwd</a> 🌐 Explore our RSAC 2025 Coverage: <a href="https://www.itspmagazine.com/events/rsac-2025" rel="nofollow noopener" translate="no" target="_blank">https://www.itspmagazine.com/events/rsac-2025</a><a href="https://infosec.exchange/tags/akamai" class="mention hashtag" rel="nofollow noopener" target="_blank">#akamai</a> <a href="https://infosec.exchange/tags/rsac2025" class="mention hashtag" rel="nofollow noopener" target="_blank">#rsac2025</a> <a href="https://infosec.exchange/tags/brandstory" class="mention hashtag" rel="nofollow noopener" target="_blank">#brandstory</a> <a href="https://infosec.exchange/tags/apigateway" class="mention hashtag" rel="nofollow noopener" target="_blank">#apigateway</a> <a href="https://infosec.exchange/tags/applicationsecurity" class="mention hashtag" rel="nofollow noopener" target="_blank">#applicationsecurity</a> <a href="https://infosec.exchange/tags/aiinsecurity" class="mention hashtag" rel="nofollow noopener" target="_blank">#aiinsecurity</a> <a href="https://infosec.exchange/tags/webappsecurity" class="mention hashtag" rel="nofollow noopener" target="_blank">#webappsecurity</a> <a href="https://infosec.exchange/tags/cybersecurityresearch" class="mention hashtag" rel="nofollow noopener" target="_blank">#cybersecurityresearch</a> <a href="https://infosec.exchange/tags/infosec" class="mention hashtag" rel="nofollow noopener" target="_blank">#infosec</a> <a href="https://infosec.exchange/tags/devsecops" class="mention hashtag" rel="nofollow noopener" target="_blank">#devsecops</a> <a href="https://infosec.exchange/tags/digitaldefense" class="mention hashtag" rel="nofollow noopener" target="_blank">#digitaldefense</a> <a href="https://infosec.exchange/tags/threatintelligence" class="mention hashtag" rel="nofollow noopener" target="_blank">#threatintelligence</a> <a href="https://infosec.exchange/tags/itspmagazine" class="mention hashtag" rel="nofollow noopener" target="_blank">#itspmagazine</a> <a href="https://infosec.exchange/tags/rsaconference" class="mention hashtag" rel="nofollow noopener" target="_blank">#rsaconference</a> <a href="https://infosec.exchange/tags/apisecurity" class="mention hashtag" rel="nofollow noopener" target="_blank">#apisecurity</a> <a href="https://infosec.exchange/tags/aiattacks" class="mention hashtag" rel="nofollow noopener" target="_blank">#aiattacks</a> <a href="https://infosec.exchange/tags/securityreport" class="mention hashtag" rel="nofollow noopener" target="_blank">#securityreport</a> <a href="https://infosec.exchange/tags/cybersecurityinnovation" class="mention hashtag" rel="nofollow noopener" target="_blank">#cybersecurityinnovation</a> <a href="https://infosec.exchange/tags/securitystrategy" class="mention hashtag" rel="nofollow noopener" target="_blank">#securitystrategy</a> <a href="https://infosec.exchange/tags/zerotrust" class="mention hashtag" rel="nofollow noopener" target="_blank">#zerotrust</a> <a href="https://infosec.exchange/tags/appsec" class="mention hashtag" rel="nofollow noopener" target="_blank">#appsec</a>

Miguel Afonso Caetano"API keys are foundational elements for authentication, but relying solely on them is inherently a risky proposal.Firstly, there’s the reality that API keys are not securely designed — they were never meant to be used as the sole form of authentication, and as such, they aren’t really built for the task. These keys can often be easily stolen, leaked, or, in some cases (especially if generated incrementally), outright guessed. An API key is suitable for tracking usage but is poor for security.There is also the additional reality that keys in their default state lack some critical functionality. There’s not a lot of verification built-in for identity management, and what does exist offers very little in the way of granular access control.Ultimately, solely relying on API keys is a mistake common with novice developers but frighteningly common even in advanced products.Best Practices Instead of relying heavily on API keys as a sole mechanism, combine those keys with additional approaches such as OAuth 2.0 or mTLS. Implement rigorous expiration and rotation policies to ensure that keys which are made public are only useful for a short amount of time. Consider more advanced approaches, such as IP whitelisting or device fingerprinting, to add another layer of security atop the API key process."<a href="https://nordicapis.com/9-signs-youre-doing-api-security-wrong/" rel="nofollow noopener" translate="no" target="_blank">https://nordicapis.com/9-signs-youre-doing-api-security-wrong/</a><a href="https://tldr.nettime.org/tags/API" class="mention hashtag" rel="nofollow noopener" target="_blank">#API</a> <a href="https://tldr.nettime.org/tags/APIs" class="mention hashtag" rel="nofollow noopener" target="_blank">#APIs</a> <a href="https://tldr.nettime.org/tags/APISecurity" class="mention hashtag" rel="nofollow noopener" target="_blank">#APISecurity</a> <a href="https://tldr.nettime.org/tags/APIDesign" class="mention hashtag" rel="nofollow noopener" target="_blank">#APIDesign</a> <a href="https://tldr.nettime.org/tags/WebSecurity" class="mention hashtag" rel="nofollow noopener" target="_blank">#WebSecurity</a> <a href="https://tldr.nettime.org/tags/CyberSecurity" class="mention hashtag" rel="nofollow noopener" target="_blank">#CyberSecurity</a>

Sam Stepanyan :verified: 🐘<a href="https://infosec.exchange/tags/Docker" class="mention hashtag" rel="nofollow noopener" target="_blank">#Docker</a> Fixes Critical 5-year Old Authentication Bypass <a href="https://infosec.exchange/tags/Vulnerability" class="mention hashtag" rel="nofollow noopener" target="_blank">#Vulnerability</a> CVE-2024-41110 (CVSS:10.0) allows attacker to login by sending an API request with a Content-Length of 0! <a href="https://infosec.exchange/tags/APISecurity" class="mention hashtag" rel="nofollow noopener" target="_blank">#APISecurity</a> 👇 <a href="https://www.bleepingcomputer.com/news/security/docker-fixes-critical-5-year-old-authentication-bypass-flaw/" rel="nofollow noopener" translate="no" target="_blank">https://www.bleepingcomputer.com/news/security/docker-fixes-critical-5-year-old-authentication-bypass-flaw/</a>

Sam Stepanyan :verified: 🐘<a href="https://infosec.exchange/tags/Twilio" class="mention hashtag" rel="nofollow noopener" target="_blank">#Twilio</a> has confirmed that an unsecured API endpoint allowed <a href="https://infosec.exchange/tags/ShinyHunters" class="mention hashtag" rel="nofollow noopener" target="_blank">#ShinyHunters</a> threat actors to verify and leak the phone numbers of 33 million of Authy MFA users: <a href="https://infosec.exchange/tags/APISecurity" class="mention hashtag" rel="nofollow noopener" target="_blank">#APISecurity</a> 👇 <a href="https://www.bleepingcomputer.com/news/security/hackers-abused-api-to-verify-millions-of-authy-mfa-phone-numbers/" rel="nofollow noopener" translate="no" target="_blank">https://www.bleepingcomputer.com/news/security/hackers-abused-api-to-verify-millions-of-authy-mfa-phone-numbers/</a>

Neil MaddenSlides from my talk on Macaroons from <a href="https://infosec.exchange/tags/SecAppDev" class="mention hashtag" rel="nofollow noopener" target="_blank">#SecAppDev</a> are now available (click Download Handouts). It wasn’t recorded, so I’ll maybe do it on twitch or something. <a href="https://secappdev.org/2024/sessions/introduction-to-macaroons/" rel="nofollow noopener" translate="no" target="_blank">https://secappdev.org/2024/sessions/introduction-to-macaroons/</a> <a href="https://infosec.exchange/tags/cryptography" class="mention hashtag" rel="nofollow noopener" target="_blank">#cryptography</a> <a href="https://infosec.exchange/tags/apisecurity" class="mention hashtag" rel="nofollow noopener" target="_blank">#apisecurity</a>

Recent searches

Search options

Administered by:

Server stats: