Seven checklists covering the audit surface of HTTP, GraphQL, and gRPC APIs. Each checklist is structured as audit questions paired with concrete tests and mitigations, not abstract guidance.
Every checklist has three parts:
- Audit questions, what to ask the team or determine from the codebase
- Tests, specific requests, payloads, or fuzzing patterns
- Mitigations, controls to add, ordered by impact
| # | Checklist | Focus |
|---|---|---|
| 01 | REST OWASP API Top 10 | The full OWASP API Security Top 10 mapped to audit questions |
| 02 | GraphQL | Introspection, query depth, alias abuse, batched queries, field auth |
| 03 | gRPC | Reflection, message-size limits, metadata trust, streaming abuse |
| 04 | BOLA / IDOR | Object-level authorization gaps; the most-exploited API class |
| 05 | Mass assignment | Over-posting, allow-list vs deny-list, auto-binding pitfalls |
| 06 | Broken authentication | JWT issues, session fixation, OAuth misuse, credential stuffing |
| 07 | Rate limiting and introspection | Quotas, abuse cost, leaked debug endpoints, error verbosity |
Use this in code review, design review, or a focused audit window. Each checklist runs about 15 to 60 minutes depending on API size. The tests are written assuming you have access to the API and a couple of test accounts; nothing requires a full lab environment.
The OWASP API Top 10 is referenced because the categories are useful, not because the project is endorsed. Where the OWASP wording is vague, this checklist substitutes a more specific question.
If a test produces false positives in your environment, file an issue with the framework or platform involved. PRs that add language-specific notes (e.g. Rails strong-params, Django serializers, Spring @RequestBody) under each checklist are welcome.
Part of a 10-repo security audit set.
Browser-based audit tools:
- iam-policy-analyzer
- terraform-security-linter
- kubernetes-manifest-security-scanner
- session-cookie-auditor
- regex-redos-checker
Reference collections:
- incident-response-runbooks
- ai-llm-security-audit
- secrets-leak-response-runbook
- threat-modeling-worksheets
Part of a catalog of single-file browser tools and plain-language references, all MIT licensed and dependency-free: 0xelitesystem.github.io. Built by elitesystem.ai.
MIT. See LICENSE.