API Security Articles — LazyHackers

back to API Security

Auth & Authorization

API Security → Auth & Authorization

API Security Premium

May 24, 2026

a non-admin reaches admin-only routes because authorisation was bolted on per-handler instead of built into the architecture. Verb…

17m

API Security Premium

May 24, 2026

all the ways the "who are you" half of auth quietly breaks in production: credential stuffing, missing rate limits, broken passwor…

21m

API Security Premium

May 24, 2026

the server checks who you are but never checks whether the object you asked for is actually yours. Id-flips, the UUID myth, nested…

21m