What is API / microservice security? A guide from Port Swigger
Summary: PortSwigger's guide explains that APIs let software request data from other software under a strict definition, and that because APIs are consumed mainly by developers and machines, their security is often overlooked, leaving gaps that let attackers edit client-submitted parameters to reach restricted data. It cites a 2020 Akamai "State of the Internet" report finding API abuses a growing threat, particularly in financial services, and notes Starbucks paid a critical bug bounty in early 2020 for an API flaw potentially exposing records of up to 100 million customers.
What you should know: Microservice architectures multiply the interactions between systems, and the guide notes many organizations cannot even list all the APIs on their systems - so endpoints a scanner never finds stay untested while the data behind them grows more sensitive.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026