API Security Review

No production access is required and none is requested. The static review works from your OpenAPI / Swagger / GraphQL / gRPC specs alone. If dynamic testing is in scope it runs against a non-production environment with synthetic accounts and synthetic test data - we never authenticate as a real customer, never query real PII / PHI / cardholder records, and never send traffic to production endpoints. Test traffic is rate-limited and pre-coordinated with your team.

REST (OpenAPI 3, Swagger 2), GraphQL (SDL or introspection), gRPC (.proto), Connect, WebSockets, Server-Sent Events, AsyncAPI / event-driven APIs, outbound webhooks, and LLM / agentic API endpoints. Across AWS API Gateway, Azure API Management, Google Apigee and Cloud Endpoints, Kong, Tyk, Mulesoft Anypoint, WSO2, Envoy / Istio / Linkerd service mesh, Solo Gloo, Cloudflare API Gateway, or direct application exposure.

BOLA / IDOR (API1 in OWASP API Top 10 2023) is the most common and highest-impact API vulnerability - and it is the one scanners struggle with most because it requires understanding object ownership and authorisation logic, not just spec compliance. A senior security engineer manually models authorisation per endpoint with multiple test users across multiple tenants to find BOLA, BFLA (function-level), and broken object property authorisation (mass assignment, over-fetching) that no automated tool catches. This is typically where 60-80% of high-severity findings come from.

Yes. GraphQL coverage adds query depth and cost analysis (denial of service via deeply-nested queries), batching attacks, alias abuse, introspection leakage in production, field-suggestions disclosure, broken authorisation at the field and resolver level (a major GraphQL gap because authorisation must run per-resolver, not per-endpoint), persisted query enforcement, and cost-budget rate limiting. We use GraphQL Inspector, InQL, GraphQL Cop, and GraphQL Voyager alongside manual schema review.

Yes. For LLM / agentic API endpoints we add OWASP LLM Top 10 coverage - prompt injection (direct and indirect), insecure output handling, training-data poisoning risk, model denial of service, supply-chain risk, sensitive information disclosure in completions, insecure plugin / tool / MCP-server design, excessive agency in tool calling, overreliance on model output, and model theft. Combined with the standard OWASP API Top 10 review of the surrounding API surface, this is one of the only audits today that treats AI agent endpoints as the high-risk APIs they are.

We review WAF rule coverage at the gateway, CDN, and origin layers (AWS WAF including Bot Control, Cloudflare WAF + Bot Management, Azure Front Door + WAF, Akamai App and API Protector, Imperva, F5 Distributed Cloud, OWASP CRS), bot defence and CAPTCHA strategy (DataDome, Arkose, hCaptcha, Cloudflare Turnstile), credential-stuffing and account-takeover protection, scraping defence, and per-tenant rate-limiting strategy. The output is a concrete WAF rule-set and bot-defence configuration plan - not just a list of CVEs.

No. Dynamic testing is rate-limited (configurable, typically 5-20 req/s per endpoint), pre-coordinated with your team, scheduled outside high-traffic windows, and uses synthetic accounts only. We can pre-coordinate with your detection team if your SIEM / WAF will flag the activity, and we always pause if any shared dependency starts showing impact.

Typical turnaround is 3-5 business days from spec delivery (and from non-prod access if dynamic testing is in scope), plus a 45-minute live findings walkthrough at a time that suits your security and engineering leads. Larger surfaces with hundreds of endpoints across REST, GraphQL, and gRPC can take a little longer; we confirm the timeline as soon as we see the scope.