cyberaudit-skill 3.0.5 → 3.0.7

package/skills/cyberaudit/SKILL.md

@@ -5,7 +5,7 @@ description: >
   Use when auditing source code for vulnerabilities — full methodology from
   quick scan to red team. Follows OWASP Top 10 2023, CVSS 3.1, ASVS 4.0.
   Trigger: "audit", "security", "vulnerability", "pentest", "OWASP",
-  "scan my code", "security review".
+  "scan my code", "security review", "commands", "help".
 compatibility: Pure Markdown skill, no external dependencies. Works with any AI agent that loads SKILL.md.
 metadata:
   author: ArisRoman
@@ -13,16 +13,92 @@ metadata:
   allowed-tools: Read Edit Grep Glob Bash
 ---
 
-# CyberAudit Skill v3.0 — LUNAIRE EDITION
+# CyberAudit Skill
 
 Security audit intelligence for AI agents. Universal, framework-agnostic, methodology-driven.
 
+## Available Commands
+
+### Global
+| Command | Action |
+|---|---|
+| `/audit` | Full audit (auto-detect web/mobile) |
+| `/audit:quick` | Quick scan — criticals only |
+| `/audit:report` | Generate full report |
+| `/audit:exec` | Generate executive summary |
+
+### Web
+| Command | Action |
+|---|---|
+| `/audit:web` | Full web audit (OWASP Top 10) |
+| `/audit:auth` | Authentication & Authorization |
+| `/audit:injection` | SQL, NoSQL, Command, SSTI |
+| `/audit:xss` | Cross-Site Scripting |
+| `/audit:csrf` | Cross-Site Request Forgery |
+| `/audit:cors` | CORS configuration |
+| `/audit:headers` | HTTP security headers |
+| `/audit:secrets` | Exposed secrets & credentials |
+| `/audit:deps` | Dependencies & supply chain |
+| `/audit:ssrf` | Server-Side Request Forgery |
+| `/audit:idor` | IDOR & access control |
+| `/audit:logic` | Business logic flaws |
+| `/audit:crypto` | Web cryptography |
+| `/audit:xxe` | XML External Entities |
+| `/audit:deserial` | Insecure deserialization |
+| `/audit:laravel` | Laravel-specific audit |
+| `/audit:nextjs` | Next.js-specific audit |
+| `/audit:react` | React-specific audit |
+| `/audit:nestjs` | NestJS-specific audit |
+| `/audit:express` | Express-specific audit |
+| `/audit:vue` | Vue.js-specific audit |
+| `/audit:angular` | Angular-specific audit |
+
+### Mobile
+| Command | Action |
+|---|---|
+| `/audit:mobile` | Full mobile audit (OWASP MASVS) |
+| `/audit:storage` | Local storage security |
+| `/audit:network` | Network security |
+| `/audit:binary` | Binary analysis |
+| `/audit:permissions` | Permissions audit |
+| `/audit:deeplinks` | Deep links & IPC |
+| `/audit:auth-mobile` | Mobile authentication |
+| `/audit:crypto-mobile` | Mobile cryptography |
+| `/audit:runtime` | Runtime security |
+| `/audit:react-native` | React Native audit |
+| `/audit:flutter` | Flutter audit |
+| `/audit:ionic` | Ionic audit |
+| `/audit:expo` | Expo audit |
+
+### API
+| Command | Action |
+|---|---|
+| `/audit:api` | Full API audit (OWASP API Top 10) |
+| `/audit:auth-api` | API authentication & authorization |
+| `/audit:api:rest` | REST API audit |
+| `/audit:api:graphql` | GraphQL API audit |
+| `/audit:api:ws` | WebSocket API audit |
+| `/audit:api:bola` | BOLA/IDOR audit |
+| `/audit:api:bopla` | BOPLA (BFLA) audit |
+| `/audit:api:rate-limit` | Rate limiting audit |
+| `/audit:api:inventory` | API inventory/discovery |
+| `/audit:api:third-party` | Third-party API audit |
+
+### Compliance
+| Command | Action |
+|---|---|
+| `/audit:rgpd` | RGPD compliance check |
+| `/audit:pci` | PCI-DSS compliance check |
+| `/audit:hipaa` | HIPAA compliance check |
+| `/audit:masvs` | MASVS 2.0 score |
+| `/audit:owasp` | OWASP Top 10 score |
+
 ## Boot Sequence
 
 Execute on every audit request:
 
 **STEP 1 — IDENTIFICATION** (30 sec)
-- TYPE → Web / Mobile / Both
+- TYPE → Web / Mobile / API / Both
 - FRAMEWORK → Identify precisely (React, Laravel, Flutter, etc.)
 - CONTEXT → Dev / Staging / Production
 - SCOPE → Entire code / Single module
@@ -31,6 +107,7 @@ Execute on every audit request:
 **STEP 2 — MODE LOADING**
 - Web → Load web checklist + framework-specific guide
 - Mobile → Load mobile checklist + framework-specific guide
+- API → Load API checklist + type-specific guide (REST/GraphQL/WebSocket)
 
 **STEP 3 — STRUCTURED AUDIT**
 Follow the loaded philosophy. Never skip a phase. Document each finding immediately.
@@ -116,6 +193,11 @@ Every report must include:
 - **Express**: CORS, helmet, input validation, error handling
 - **NestJS**: Guards, pipes, serialization, GraphQL security
 
+### API Types
+- **REST**: Resource IDOR/BOLA, mass assignment, parameter injection, deprecated endpoints
+- **GraphQL**: Introspection, depth/complexity, batching attacks, field-level auth
+- **WebSocket**: Authentication on connect, per-message auth, origin validation, rate limiting
+
 ### Mobile Frameworks
 - **React Native**: AsyncStorage, deep links, WebView XSS, JS bundle exposure
 - **Flutter**: Method channels, root detection, local storage, obfuscation
@@ -155,9 +237,24 @@ This skill lives at `~/.skills/cyberaudit/`. Additional sub-skills:
 ├── MASTER.md             (full vulnerability taxonomy + scoring)
 ├── USAGE-GUIDE.md        (user-facing documentation)
 ├── README.md             (project overview)
+├── api/
+│   ├── API-PHILOSOPHY.md
+│   ├── API-CHECKLIST.md
+│   ├── API-REMEDIATION-LIBRARY.md
+│   ├── types/
+│   │   ├── REST.md
+│   │   ├── GRAPHQL.md
+│   │   └── WEBSOCKET.md
+│   └── vulnerabilities/
+│       ├── BOLA.md
+│       ├── BOPLA.md
+│       ├── RATE-LIMITING.md
+│       ├── INVENTORY.md
+│       └── THIRD-PARTY-API.md
 ├── reports/
 │   ├── REPORT-TEMPLATE-WEB.md
 │   ├── REPORT-TEMPLATE-MOBILE.md
+│   ├── REPORT-TEMPLATE-API.md
 │   └── EXECUTIVE-SUMMARY-TEMPLATE.md
 ├── shared/
 │   ├── COMPLIANCE.md
@@ -192,7 +289,8 @@ This skill lives at `~/.skills/cyberaudit/`. Additional sub-skills:
 ```
 
 For detailed framework-specific checks, load the appropriate file from `web/frameworks/` or `mobile/frameworks/`.
-For vulnerability-specific deep dives, load from `web/vulnerabilities/` or `mobile/vulnerabilities/`.
+For vulnerability-specific deep dives, load from `web/vulnerabilities/`, `mobile/vulnerabilities/`, or `api/vulnerabilities/`.
+For API-specific audits, load from `api/` (philosophy, checklist, type guide, remediation library).
 
 ---
 

package/skills/cyberaudit/api/API-CHECKLIST.md

@@ -0,0 +1,102 @@
+# API SECURITY CHECKLIST — CyberAudit Skill
+
+## Phase 0 — Discovery
+
+- [ ] All endpoints documented and audited
+- [ ] Shadow/deprecated endpoints identified
+- [ ] Auth mechanism identified per endpoint
+- [ ] All HTTP methods tested on each endpoint
+- [ ] Parameter variations tested
+- [ ] Content-type variations tested
+
+## Phase 1 — Authentication
+
+- [ ] JWT signature verified (not just decoded)
+- [ ] JWT `alg` restricted (no "none" algorithm)
+- [ ] JWT expiration enforced server-side
+- [ ] JWT secret strong and rotated
+- [ ] OAuth redirect_uri validated
+- [ ] OAuth state parameter used
+- [ ] API keys not exposed in URLs
+- [ ] API keys revocable
+- [ ] API keys scoped to minimum permissions
+- [ ] No hardcoded credentials in code
+- [ ] Multi-factor authentication available
+- [ ] Password hashing: bcrypt/argon2
+
+## Phase 2 — Authorization
+
+- [ ] IDOR test on every object endpoint
+- [ ] BFLA test on every admin function
+- [ ] Role-based access control enforced
+- [ ] Mass assignment protected
+- [ ] UUIDs used instead of sequential IDs
+- [ ] Object ownership verified server-side
+- [ ] Vertical privilege escalation tested
+- [ ] Horizontal privilege escalation tested
+- [ ] Indirect object reference checked
+
+## Phase 3 — Input Validation
+
+- [ ] SQL injection: parameterized queries
+- [ ] NoSQL injection: sanitize operators
+- [ ] Command injection: avoid exec() with input
+- [ ] XML injection: disable external entities
+- [ ] SSRF: validate redirect URLs
+- [ ] Path traversal: restrict file access
+- [ ] Parameter pollution: last value wins?
+- [ ] Schema validation bypass: extra fields
+- [ ] Content-type confusion: application/json vs XML
+- [ ] GraphQL: depth limiting
+- [ ] GraphQL: query complexity limiting
+- [ ] GraphQL: disable introspection in production
+
+## Phase 4 — Rate Limiting
+
+- [ ] Rate limiting on ALL endpoints
+- [ ] Stricter limits on auth endpoints
+- [ ] Rate limiting by user/IP/token
+- [ ] Proper 429 response with Retry-After
+- [ ] Brute force protection on login
+- [ ] Enumeration prevention (consistent messages)
+- [ ] Pagination has max limit
+- [ ] Pagination cursor-based for sensitive data
+- [ ] Resource usage monitoring
+
+## Phase 5 — Data Exposure
+
+- [ ] Responses contain minimum data
+- [ ] No sensitive data in error messages
+- [ ] No stack traces in production
+- [ ] No debug endpoints exposed
+- [ ] Logging excludes sensitive fields
+- [ ] PII exposure audited per endpoint
+- [ ] Consistent response format (no info leak)
+- [ ] CORS whitelist restrictive
+- [ ] CORS credentials: true without wildcard origin
+- [ ] Security headers: CSP, HSTS, X-Frame, etc.
+
+## Phase 6 — WebSocket Security
+
+- [ ] WSS enforced (no unencrypted WS)
+- [ ] Authentication on connect
+- [ ] Authorization per message
+- [ ] Input validation per message
+- [ ] Rate limiting per connection
+- [ ] Message size limits
+- [ ] Origin validation
+- [ ] Connection timeout
+- [ ] Reconnection not automatic for sensitive actions
+
+## Phase 7 — Third-Party APIs
+
+- [ ] Outgoing HTTPS enforced
+- [ ] Certificate validation (no self-signed skip)
+- [ ] Timeout configured
+- [ ] Retry logic with backoff
+- [ ] Webhook signature verified
+- [ ] Third-party data treated as untrusted
+- [ ] Third-party credentials stored securely
+- [ ] Third-party API key rotation
+- [ ] Webhook payload validation
+- [ ] IP allowlisting where possible

package/skills/cyberaudit/api/API-PHILOSOPHY.md

@@ -0,0 +1,121 @@
+# API AUDIT PHILOSOPHY — CyberAudit Skill
+# The mindset of an API security expert
+
+## The API Mental DNA
+
+An API is not a website with less HTML.
+It is a bare attack surface, no interface,
+no friction, accessible by machines
+that can send thousands of requests per second.
+
+When you audit an API, think like
+an attacker who read the entire documentation
+AND is looking for what the documentation does not say.
+
+Modern APIs have three unique characteristics
+that make them particularly dangerous:
+
+  1. THEY TRUST BY DESIGN
+     An API is built to be consumed.
+     Its nature is to accept requests.
+     The challenge: distinguish legitimate requests
+     from malicious ones.
+
+  2. THEY EXPOSE BUSINESS LOGIC DIRECTLY
+     No UI to hide functionality.
+     Every endpoint is an exposed business function.
+     An attacker reading your docs sees your architecture.
+
+  3. THEY ARE DESIGNED FOR AUTOMATION
+     What is a feature for developers
+     is a weapon for attackers.
+     A script can test 10,000 IDs in 10 seconds.
+
+## The 8 Truths of API Security
+
+TRUTH 1 — THE OBJECT IS THE ATTACK UNIT
+  On the web, you attack pages.
+  On an API, you attack objects.
+  GET /users/1 → GET /users/2 → GET /users/3...
+  IDOR is the #1 vulnerability in APIs.
+  Every endpoint with an ID is an attack vector.
+
+TRUTH 2 — AUTHENTICATION ≠ AUTHORIZATION
+  An API can perfectly authenticate a user
+  and still give them access to everyone else's data.
+  Valid token ≠ authorized access to this resource.
+
+TRUTH 3 — EVERYTHING IS AN INPUT
+  Headers, query params, body, cookies, files.
+  An API trusts what it receives.
+  Validation must happen at every boundary.
+
+TRUTH 4 — RATE LIMITING IS SECURITY
+  Without rate limiting, an API is defenseless.
+  Brute force, enumeration, DDoS — all prevented
+  by a simple rate limit.
+
+TRUTH 5 — THE DOCUMENTATION IS AN ATTACK PLAN
+  Your OpenAPI spec tells attackers exactly
+  where to look. Every endpoint described
+  is an endpoint tested.
+
+TRUTH 6 — INTERNAL APIS ARE NOT SAFE
+  "Internal only" means no WAF, no rate limiting,
+  no auth, no monitoring. Internal APIs are
+  the most vulnerable.
+
+TRUTH 7 — LEGACY ENDPOINTS ARE BACKDOORS
+  /v1/users, /api/old/orders, deprecated routes
+  that were forgotten. They still work.
+  They have weaker security.
+
+TRUTH 8 — THIRD-PARTY APIS ARE YOUR LIABILITY
+  The API you consume can be compromised.
+  The API you expose can be abused by partners.
+  Trust must be verified, not assumed.
+
+## The API Audit Flow
+
+PHASE 0 — DISCOVERY & MAPPING
+  □ List ALL endpoints (documented + undocumented)
+  □ Identify auth mechanisms per endpoint
+  □ Map data types and sensitivity
+  □ Find shadow APIs and deprecated endpoints
+  □ Test every HTTP method on every endpoint
+
+PHASE 1 — AUTHENTICATION
+  □ Token handling (JWT, OAuth, API keys)
+  □ Token validation on every endpoint
+  □ Token expiration and rotation
+  □ Weak authentication mechanisms
+
+PHASE 2 — AUTHORIZATION
+  □ IDOR/BOLA on every object access
+  □ BFLA on every admin function
+  □ Mass assignment protection
+  □ Role-based access control verification
+
+PHASE 3 — INPUT VALIDATION
+  □ Injection testing on all inputs
+  □ Parameter pollution
+  □ Content-type validation
+  □ Schema validation bypass
+
+PHASE 4 — RATE LIMITING & ABUSE
+  □ Brute force protection
+  □ Enumeration prevention
+  □ Pagination abuse
+  □ Resource exhaustion
+
+PHASE 5 — DATA EXPOSURE
+  □ Over-fetching in responses
+  □ Sensitive data in error messages
+  □ Excessive data in list endpoints
+  □ Debug endpoints exposed
+
+PHASE 6 — CONFIGURATION
+  □ CORS misconfiguration
+  □ TLS/SSL verification
+  □ Security headers
+  □ Debug mode disabled

package/skills/cyberaudit/api/API-REMEDIATION-LIBRARY.md

@@ -0,0 +1,149 @@
+# API Remediation Library — CyberAudit Skill
+
+## Authentication Fixes
+
+### JWT Hardening
+```javascript
+// Secure JWT configuration
+const jwt = require('jsonwebtoken');
+const token = jwt.sign(
+  { userId: user.id, role: user.role },
+  process.env.JWT_SECRET,
+  { algorithm: 'HS256', expiresIn: '15m', issuer: 'myapp' }
+);
+```
+- Disable 'none' algorithm
+- Verify signature on every request
+- Use short expiration (15-30 min)
+- Implement refresh token rotation
+
+### API Key Management
+```javascript
+// Hash keys before storing
+const crypto = require('crypto');
+const hash = crypto.createHash('sha256').update(rawKey).digest('hex');
+db.apiKeys.create({ hash, userId, scopes: ['read:orders'] });
+```
+- Never store raw keys in database
+- Prefix keys for identification (sk_live_xxx)
+- Support key rotation without downtime
+- Scope keys to minimum permissions
+
+## Authorization Fixes
+
+### Ownership Check Middleware
+```javascript
+function verifyOwnership(model) {
+  return async (req, res, next) => {
+    const resource = await model.findById(req.params.id);
+    if (!resource) return res.status(404).json({ error: 'Not found' });
+    if (resource.userId !== req.user.id && req.user.role !== 'admin') {
+      return res.status(403).json({ error: 'Forbidden' });
+    }
+    req.resource = resource;
+    next();
+  };
+}
+```
+
+### Role-Based Access Control
+```javascript
+function authorize(...roles) {
+  return (req, res, next) => {
+    if (!roles.includes(req.user.role)) {
+      return res.status(403).json({ error: 'Insufficient permissions' });
+    }
+    next();
+  };
+}
+// Usage: deleteUser -> authenticate, authorize('admin')
+```
+
+## Input Validation Fixes
+
+### Schema Validation (Joi)
+```javascript
+const Joi = require('joi');
+const schema = Joi.object({
+  name: Joi.string().min(2).max(100).required(),
+  email: Joi.string().email().required(),
+  role: Joi.string().valid('user', 'admin').default('user')
+});
+const { error, value } = schema.validate(req.body);
+if (error) return res.status(400).json({ error: error.details[0].message });
+```
+
+### SQL Injection Prevention
+```javascript
+// Always use parameterized queries
+db.query('SELECT * FROM users WHERE id = $1', [userId]);
+// Never: db.query(`SELECT * FROM users WHERE id = ${userId}`);
+```
+
+### NoSQL Injection Prevention
+```javascript
+// Sanitize operators before query
+function sanitize(obj) {
+  if (typeof obj !== 'object') return obj;
+  delete obj.$where; delete obj.$ne; delete obj.$regex;
+  // ... remove other dangerous operators
+}
+db.collection('users').find(sanitize(query));
+```
+
+## Rate Limiting Fixes
+
+### Express Rate Limit
+```javascript
+const rateLimit = require('express-rate-limit');
+const loginLimiter = rateLimit({
+  windowMs: 15 * 60 * 1000, // 15 minutes
+  max: 5,
+  message: { error: 'Too many attempts, try again later' },
+  standardHeaders: true,
+  legacyHeaders: false
+});
+app.use('/api/auth/login', loginLimiter);
+```
+
+## WebSocket Fixes
+
+### Authentication on Connect
+```javascript
+const WebSocket = require('ws');
+const server = new WebSocket.Server({ port: 8080 });
+server.on('connection', (socket, req) => {
+  const token = new URL(req.url, 'http://localhost').searchParams.get('token');
+  try {
+    const user = jwt.verify(token, process.env.JWT_SECRET);
+    socket.user = user; // Attach verified user
+  } catch {
+    socket.close(4001, 'Authentication failed');
+  }
+});
+```
+
+### Per-Message Authorization
+```javascript
+socket.on('message', (data) => {
+  const msg = JSON.parse(data);
+  if (msg.action === 'deleteUser') {
+    if (!socket.user.isAdmin) {
+      socket.send(JSON.stringify({ error: 'Forbidden' }));
+      return;
+    }
+    // Proceed with delete
+  }
+});
+```
+
+## Security Headers
+
+```javascript
+const helmet = require('helmet');
+app.use(helmet({
+  contentSecurityPolicy: { directives: { defaultSrc: ["'self'"] } },
+  hsts: { maxAge: 31536000, includeSubDomains: true }
+}));
+app.disable('x-powered-by');
+```

package/skills/cyberaudit/api/types/GRAPHQL.md

@@ -0,0 +1,82 @@
+# GraphQL API — Security Audit Guide
+
+## Unique Risks
+
+GraphQL changes the attack model fundamentally:
+- Single endpoint, all operations
+- Client decides what data to fetch
+- Nested queries can cause DoS
+- Introspection leaks the entire schema
+
+## Vulnerability Patterns
+
+### CRITICAL — Introspection Enabled
+```graphql
+query { __schema { types { name fields { name } } } }
+```
+An attacker gets your entire schema: all types, fields, mutations.
+Fix: disable introspection in production.
+
+### CRITICAL — No Depth Limiting
+```graphql
+query {
+  user { posts { comments { user { posts { comments { ... } } } } } }
+}
+```
+Deeply nested queries can crash the server.
+Fix: max depth limit (typically 5-7 levels).
+
+### HIGH — No Query Complexity Analysis
+Some queries are cheap (single field), some are expensive (list all).
+```graphql
+query { allUsers { posts { comments } } }
+```
+Fix: assign cost to each field, reject queries over limit.
+
+### HIGH — Batching Attacks
+```graphql
+query {
+  u1: user(id: 1) { creditCard }
+  u2: user(id: 2) { creditCard }
+  # ... 500 more
+}
+```
+Single query enumerates many records.
+Fix: rate limit by query complexity, not just by request count.
+
+### HIGH — Missing Authorization
+GraphQL resolves fields independently. A field might be authorized at the query level but not at the nested resolver level.
+```
+User.orders → authorized in resolver ✓
+User.orders[0].adminNotes → resolver forgets auth check ✗
+```
+Fix: authorize every resolver independently.
+
+### MEDIUM — Field Suggestions
+```
+query { uesrs { name } }
+# Response: "Did you mean 'users'?"
+```
+Suggestions leak valid field names.
+Fix: disable suggestions in production.
+
+### MEDIUM — Mutations Without Rate Limiting
+Mutations modify data. Unchecked mutations allow:
+- Mass account creation
+- Mass password reset requests
+- Rapid data modification
+
+Fix: stricter rate limits on mutations vs queries.
+
+## GraphQL-Specific Best Practices
+
+1. Disable introspection in production
+2. Implement query depth limiting
+3. Implement query complexity analysis
+4. Rate limit by query complexity, not count
+5. Authorize every resolver independently
+6. Disable field suggestions
+7. Use persisted queries where possible
+8. Limit batch request size
+9. Validate all mutation inputs strictly
+10. Monitor for abnormal query patterns

package/skills/cyberaudit/api/types/REST.md

@@ -0,0 +1,71 @@
+# REST API — Security Audit Guide
+
+## Threat Model
+
+REST APIs are resource-oriented. Each endpoint maps to a CRUD operation on a resource. The attack surface is every URL + method combination.
+
+## Vulnerability Patterns
+
+### CRITICAL — IDOR/BOLA
+Every resource access must verify ownership.
+```
+GET /api/orders/1     → verify order belongs to user
+PUT /api/users/2/role → verify admin + ownership
+```
+Test: replace IDs sequentially, check access.
+
+### CRITICAL — Mass Assignment
+Extra fields in request body modify protected attributes.
+```
+POST /api/users
+{ "name": "test", "role": "admin" }  ← role should be ignored
+```
+Fix: whitelist allowed fields server-side.
+
+### CRITICAL — Injection in Parameters
+URL params, query strings, headers all carry injection risk.
+```
+GET /api/users?search=' OR 1=1 --
+GET /api/users?sort=email; DROP TABLE users --
+```
+Fix: parameterized queries, input validation.
+
+### HIGH — Authentication Bypass
+```
+GET /api/admin/users            ← 401 Unauthorized
+GET /api/admin/users?role=admin  ← 200 OK (bypass via param)
+```
+Fix: auth middleware on route groups, not individual handlers.
+
+### HIGH — Improper Asset Management
+Deprecated endpoints still active:
+```
+GET /api/v1/users  (current)
+GET /api/v0/users  (old, no auth)
+```
+Fix: decommission old versions, redirect with 410.
+
+### MEDIUM — Excessive Data Exposure
+```
+GET /api/users returns:
+{ "id": 1, "name": "John", "ssn": "123-45-6789", "password_hash": "$2a$..." }
+```
+Fix: Response DTOs, exclude sensitive fields.
+
+### MEDIUM — Rate Limiting Absent
+Without rate limiting:
+- Brute force login: 1000 tries/min
+- Enumeration: scan all user IDs
+- DoS: flood expensive endpoints
+
+Fix: rate limiting per user/IP/token.
+
+## REST-Specific Best Practices
+
+1. Use proper HTTP methods (GET read, POST create, PUT full update, PATCH partial)
+2. Return proper status codes (401 unauth, 403 forbidden, 429 rate limit)
+3. Validate Content-Type header (reject unexpected formats)
+4. Never expose internal IDs in URLs if sequential
+5. Use HATEOAS links carefully (don't leak endpoints)
+6. Version your API properly (URL or header based)
+7. Document all endpoints (but don't include security details)