API security checklist: 15 checks before you ship.

Modern SaaS applications are thin client interfaces powered by rich REST and GraphQL APIs. When vulnerabilities surface in production, they almost always reside in backend API logic rather than UI frontends.

The 15-Point Pre-Flight Audit

1. 01Enforce HTTPS and HSTS everywhere without TLS downgrade allowances.
2. 02Validate all incoming payload schemas with strict allowlists (e.g. Zod/Joi).
3. 03Disable Mass Assignment: ensure users cannot inject `isAdmin: true` or `role: 'superadmin'`.
4. 04Configure per-user and per-IP rate limiting on authentication and sensitive export endpoints.
5. 05Set sensible JWT lifetimes (15 minutes for access tokens, rotating refresh tokens).
6. 06Validate signature algorithm (`alg: RS256`), rejecting `none` and symmetric mismatches.
7. 07Restrict CORS origins explicitly — never return `Access-Control-Allow-Origin: *` with credentials.
8. 08Sanitize SQL/NoSQL queries using parameterization exclusively.
9. 09Filter sensitive data from error responses (no stack traces or internal DB schema dumps).
10. 10Implement pagination and strict limit caps on collection queries (`limit <= 100`).
11. 11Bound GraphQL query depth and batch complexity to prevent resource exhaustion attacks.
12. 12Enforce authorization checks on all sub-resources and related entity lookups.
13. 13Log all authentication failures, privilege escalations, and state-changing mutations with audit context.
14. 14Mask customer secrets and PII in application debug logs.
15. 15Verify asset ownership before any automated security test window runs.