c/api-security

Rate limit headers are a suggestion until they aren't

Found out the hard way that our API gateway was silently dropping our custom X-RateLimit-Remaining header for CORS requests. We built our whole client-side throttling around that header, and it worked in staging for 3 weeks. Went to production on a Tuesday and our partner integration started hammering us with 429s because their code read the header as null and assumed infinite quota. The stat that got me was that 38% of our traffic was affected before we caught it. Anyone else trust vendor gateway headers without verifying them first?

Can we talk about how I missed a basic API key leak for 3 years

I run a small SaaS out of Austin and I always thought I had things locked down. Last month a security scan from a client flagged one of our endpoints, and I found a hardcoded API key in a public GitHub repo from 2021. The scary part is that key had admin scope on our billing API, and nobody noticed because our logs didn't track which key was being used. Has anyone else had a moment where a simple audit would've saved you months of risk?

Bought a $400 API security scanner and it flagged my own test endpoints as threats

Spent a full Saturday feeding it traffic from my staging server in Chicago and it kept alerting on the health check route, which is just a GET with no auth. Anyone else had a commercial scanner make you chase false positives harder than actually fixing real issues?

Spent $600 on an API gateway and it made our rate limiting worse

I paid for a managed gateway expecting it to just work, but the default config let a burst of 2,000 requests through before the sliding window kicked in, so has anyone else found the homegrown middleware actually handles spikes better?

Lost $220 on a pen test that missed the obvious stuff

Tbh I paid a firm to do a full API pen test on our payment endpoints and they came back with a clean report after 3 weeks. A month later a buddy of mine found an IDOR just by poking around with a free tool. Has anyone else had better luck with smaller shops or individual researchers instead of the big companies?

My API key rotation went from quarterly to weekly after a breach scare

We got hit with a leaked key in a public GitHub repo back in March, someone scraped it within 4 hours and ran up a $2,300 bill on our cloud account. Now I rotate every Monday morning with a script that also revokes old keys, has anyone else automated their rotation or are you still doing it manually?

My API rate limit habit was backwards for 2 years

I used to set rate limits super high on every endpoint because I thought customer frustration was the worst outcome. Then last month a partner integration in Seattle hit my orders API 4,000 times per minute and brought down the whole service for 11 minutes. That outage cost us a contract worth about $18k and made me finally read the logs, which showed the real problem was my lack of queueing, not the limits. Has anyone else found that throttling early and often actually builds trust with clients who expect bursts? I'm curious how others balance 429s against protecting the core.

OAuth token refresh blew up our staging env at 2pm on a Friday

We had a cron job that rotated refresh tokens for our internal dashboard API. Last Friday it hit a race condition where two workers grabbed the same token, both tried to refresh it, and the second one got a 401. My first thought was just retry it, but the retry logic was dumb and kept hammering the endpoint. Locked out the entire staging environment for our QA team for about 40 minutes. Had to manually revoke all sessions and write a quick mutex to serialize refreshes. Has anyone else hit this with their refresh token flow? I'm wondering if there's a standard way to handle concurrent refreshes without building my own lock.

Had a terrible API security week after I left a debug endpoint live for 48 hours

Someone scraped 3,000 customer records through a /dev/test-orders endpoint I forgot to lock down before pushing to production, and tracking down which IPs hit it took me two days. Anyone else been burned by a forgotten staging route in prod?

Everyone forgets to rate limit their authentication endpoints

I've been doing security reviews for a small SaaS company here in Denver for about 6 months. Every single time I check their API, they have no rate limiting on the login or password reset routes. Last week I ran a simple script from my laptop and guessed 500 passwords in under 2 minutes before they noticed. This makes brute force attacks way too easy for anyone with a basic computer. You have to cap requests to like 5 per minute on those auth endpoints. Has anyone else seen this slip through their own code reviews?

Just wasted $800 on a rate limiting tool that broke everything

APIsec vs Salt Security for an API-first SaaS?

Our team is debating APIsec vs Salt Security for our API security needs. We’re API-first and deploy multiple times a day, so we need something that fits into the pipeline. Anyone compared these two? I know Salt is more runtime, but how does APIsec fit in?