API security is the practice of protecting application programming interfaces from unauthorized access, data leakage, abuse, and service…

The leading API security company, providing the context needed to discover APIs, stop attacks, and remediate vulnerabilities to accelerate business innovation.

An API development platform with a critical API flaw itself, was vulnerable to full platform takeover through a mass assignment attack.

Artificial intelligence security specialists at Apiiro have uncovered thousands of leaked credentials exposed via Claude Code settings files on GitHub.

API security protects the data, identities, and business workflows exposed through your applications. Learn risks, controls, costs, and decisions.

The threat actor lurked behind bots posing as agents from OpenAI, Anthropic, Meta, and others to find exposed data.

How using partial string matching to distinguish public and private routes leads to authentication bypass vulnerabilities

I started auth-api to stop following tutorials and build something of my own. It's a small authentication API (register, login and a protected route) built with Node, Express, Drizzle ORM and MySQL. For a while I only cared th

We’re a group of security and technology experts with a mission to fix gaps in application security.

Cybercriminals are hijacking corporate AI accounts and stealing LLM API tokens, leaving companies facing more than $100,000 in fraudulent charges per day. In this episode, we explore the growing threat of LLMJacking, how attackers exploit stolen API keys and cloud credentials, and why AI infrastructure is becoming a lucrative target for cybercrime. Discover Google's Mandiant findings, the rise of underground LLM services, and the essential security measures organizations need to protect their AI resources, cloud environments, and budgets.

Byoky is an open-source AI API key wallet that lets AI apps use your keys without seeing them, but its no-servers claim needs a closer look.

Beyond coding mistakes and misconfiguration errors, API vulnerabilities often stem from false assumptions about API security and where and how it should be applied.

How per-route authentication enforcement is prone to development mistakes and security flaws.

This vulnerability (CWE-862) in WSO2 API Manager allows unauthorized access to System REST APIs when WSO2 Identity Server is configured as a Resident Key Manager with database sharing. A self-registered user can exploit this by obtaining a

The leading API security company, providing the context needed to discover APIs, stop attacks, and remediate vulnerabilities to accelerate business innovation.

A training platform leaks sensitive military and defense sector data through an API showing signs of Broken Functional Level Authorization (OWASP 2023:API5)

A South Korean government-sponsored platform suffered a critical API data breach. Did the frontend mask risks lurking in the backend until it was too late?

We’re a group of security and technology experts with a mission to fix gaps in application security.

The leading API security company, providing the context needed to discover APIs, stop attacks, and remediate vulnerabilities to accelerate business innovation.