--- name: api-security-review-33007afd201e description: API security checklist for reviewing endpoints before deployment. Use when creating or modifying API routes to ensure proper authentication, authorization, and input validation. progressive_disclosure: entry_point: - summary - when_to_use - quick_checklist sections: - authentication - authorization - input_validation - output_safety - logging - example_secure_endpoint - framework_patterns - common_vulnerabilities --- # API Security Review Skill ## Summary Comprehensive security checklist for API endpoint development. Ensures proper authentication, authorization, input validation, output safety, and security logging are implemented before deployment. ## When to Use - Before merging any PR with API changes - When creating new API endpoints - When modifying authentication/authorization logic - During security audits - Code review of API routes ## Quick Checklist ### Pre-Deployment Security Audit - [ ] **Authentication**: Route requires valid user identity - [ ] **Authorization**: Ownership/permission checks implemented - [ ] **Input Validation**: All inputs validated with schema (Zod/Joi/etc.) - [ ] **Output Safety**: No sensitive data exposed in responses - [ ] **Logging**: Security events logged appropriately - [ ] **Rate Limiting**: Protection against abuse configured - [ ] **Error Handling**: No system information leaked in errors --- ## Authentication ### Requirements Every API endpoint must verify the user's identity before processing requests. ### Next.js (App Router) with Clerk ```typescript import { auth } from '@clerk/nextjs'; import { NextResponse } from 'next/server'; export async function GET(request: Request) { // 1. Authenticate request const { userId } = await auth(); if (!userId) { return NextResponse.json( { error: "Unauthorized" }, { status: 401 } ); } // Continue with authenticated request... } ``` ### Express.js with JWT ```typescript import jwt from 'jsonwebtoken'; import { Request, Response, NextFunction } from 'express'; function authenticateToken(req: Request, res: Response, next: NextFunction) { const authHeader = req.headers['authorization']; const token = authHeader && authHeader.split(' ')[1]; if (!token) { return res.sendStatus(401); } jwt.verify(token, process.env.JWT_SECRET!, (err, user) => { if (err) return res.sendStatus(403); req.user = user; next(); }); } app.get('/api/protected', authenticateToken, (req, res) => { // Request is authenticated }); ``` ### FastAPI with OAuth2 ```python from fastapi import Depends, HTTPException, status from fastapi.security import OAuth2PasswordBearer oauth2_scheme = OAuth2PasswordBearer(tokenUrl="token") async def get_current_user(token: str = Depends(oauth2_scheme)): user = await verify_token(token) if not user: raise HTTPException( status_code=status.HTTP_401_UNAUTHORIZED, detail="Invalid authentication credentials", headers={"WWW-Authenticate": "Bearer"}, ) return user @app.get("/api/protected") async def protected_route(current_user: User = Depends(get_current_user)): return {"user": current_user.email} ``` ### Django REST Framework ```python from rest_framework.decorators import api_view, permission_classes from rest_framework.permissions import IsAuthenticated from rest_framework.response import Response @api_view(['GET']) @permission_classes([IsAuthenticated]) def protected_view(request): # request.user is authenticated return Response({'user': request.user.email}) ``` --- ## Authorization ### Resource Ownership Verification Authentication proves WHO the user is. Authorization proves the user has permission to access the resource. ### Next.js Example ```typescript import { auth } from '@clerk/nextjs'; import { NextResponse } from 'next/server'; import { db } from '@/lib/db'; import { eq } from 'drizzle-orm'; export async function GET( request: Request, { params }: { params: { id: string } } ) { // 1. Authenticate const { userId } = await auth(); if (!userId) { return NextResponse.json({ error: "Unauthorized" }, { status: 401 }); } // 2. Fetch resource const resource = await db.query.resources.findFirst({ where: eq(resources.id, params.id) }); if (!resource) { return NextResponse.json({ error: "Not found" }, { status: 404 }); } // 3. Authorize - Check ownership if (resource.ownerId !== userId) { return NextResponse.json({ error: "Forbidden" }, { status: 403 }); } // 4. Return authorized data return NextResponse.json(resource); } ``` ### Role-Based Access Control (RBAC) ```typescript enum Role { USER = 'user', ADMIN = 'admin', MODERATOR = 'moderator' } function requireRole(allowedRoles: Role[]) { return async (request: Request) => { const { userId } = await auth(); if (!userId) { return NextResponse.json({ error: "Unauthorized" }, { status: 401 }); } const user = await db.query.users.findFirst({ where: eq(users.clerkId, userId) }); if (!user || !allowedRoles.includes(user.role)) { return NextResponse.json({ error: "Forbidden" }, { status: 403 }); } return null; // Authorized }; } export async function DELETE(request: Request) { const authError = await requireRole([Role.ADMIN, Role.MODERATOR])(request); if (authError) return authError; // User is authorized as admin or moderator } ``` ### Multi-Tenant Data Isolation ```typescript // CRITICAL: Prevent cross-tenant data leaks // ❌ WRONG - No tenant check const orders = await db.query.orders.findMany({ where: eq(orders.userId, userId) }); // ✅ CORRECT - Tenant isolation const user = await db.query.users.findFirst({ where: eq(users.clerkId, userId) }); const orders = await db.query.orders.findMany({ where: and( eq(orders.userId, userId), eq(orders.tenantId, user.tenantId) // CRITICAL: tenant boundary ) }); ``` --- ## Input Validation ### Zod Schema Validation (TypeScript) ```typescript import { z } from 'zod'; import { NextResponse } from 'next/server'; const updateUserSchema = z.object({ id: z.string().uuid(), email: z.string().email().optional(), age: z.number().int().min(0).max(150).optional(), role: z.enum(['user', 'admin', 'moderator']).optional(), }); export async function PATCH(request: Request) { const { userId } = await auth(); if (!userId) { return NextResponse.json({ error: "Unauthorized" }, { status: 401 }); } // Parse and validate input const body = await request.json(); const result = updateUserSchema.safeParse(body); if (!result.success) { return NextResponse.json({ error: "Validation failed", details: result.error.issues }, { status: 400 }); } // Safe to use validated data const validatedData = result.data; // ... update logic } ``` ### Pydantic Validation (Python) ```python from pydantic import BaseModel, EmailStr, Field, validator from fastapi import HTTPException class UpdateUser(BaseModel): id: str = Field(..., regex=r'^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$') email: EmailStr | None = None age: int | None = Field(None, ge=0, le=150) role: str | None = Field(None, regex=r'^(user|admin|moderator)$') @validator('email') def email_must_not_be_disposable(cls, v): if v and any(domain in v for domain in ['tempmail.com', '10minutemail.com']): raise ValueError('Disposable email addresses not allowed') return v @app.patch("/api/users") async def update_user(user_data: UpdateUser, current_user: User = Depends(get_current_user)): # user_data is validated return {"status": "updated"} ``` ### SQL Injection Prevention ```typescript // ❌ NEVER: Raw SQL with string interpolation const userId = request.params.id; const query = `SELECT * FROM users WHERE id = '${userId}'`; // VULNERABLE! db.execute(query); // ✅ ALWAYS: Use ORM or parameterized queries import { eq } from 'drizzle-orm'; const user = await db.query.users.findFirst({ where: eq(users.id, userId) }); // ✅ OR: Parameterized raw query const [user] = await db.execute( 'SELECT * FROM users WHERE id = ?', [userId] ); ``` ### File Upload Validation ```typescript const MAX_FILE_SIZE = 5 * 1024 * 1024; // 5MB const ALLOWED_TYPES = ['image/jpeg', 'image/png', 'image/gif']; export async function POST(request: Request) { const formData = await request.formData(); const file = formData.get('file') as File; if (!file) { return NextResponse.json({ error: "No file provided" }, { status: 400 }); } // Validate file size if (file.size > MAX_FILE_SIZE) { return NextResponse.json({ error: "File too large. Max 5MB" }, { status: 400 }); } // Validate file type if (!ALLOWED_TYPES.includes(file.type)) { return NextResponse.json({ error: "Invalid file type. Only JPEG, PNG, GIF allowed" }, { status: 400 }); } // Process file... } ``` --- ## Output Safety ### Remove Sensitive Data from Responses ```typescript // ❌ WRONG - Exposing sensitive fields const user = await db.query.users.findFirst({ where: eq(users.id, userId) }); return NextResponse.json(user); // Includes password hash, internal IDs, etc. // ✅ CORRECT - Explicitly select safe fields const user = await db.query.users.findFirst({ where: eq(users.id, userId), columns: { id: true, email: true, name: true, createdAt: true, // Exclude: passwordHash, internalNotes, apiKey, etc. } }); return NextResponse.json(user); // ✅ BETTER - Use DTOs interface PublicUserDTO { id: string; email: string; name: string; createdAt: Date; } function toPublicUser(user: User): PublicUserDTO { return { id: user.id, email: user.email, name: user.name, createdAt: user.createdAt }; } return NextResponse.json(toPublicUser(user)); ``` ### Mask PII in Logs ```typescript function sanitizeForLogging(data: any) { const sanitized = { ...data }; // Mask email if (sanitized.email) { const [local, domain] = sanitized.email.split('@'); sanitized.email = `${local.slice(0, 2)}***@${domain}`; } // Mask SSN if (sanitized.ssn) { sanitized.ssn = `***-**-${sanitized.ssn.slice(-4)}`; } // Remove sensitive fields delete sanitized.passwordHash; delete sanitized.apiKey; return sanitized; } console.log('User updated:', sanitizeForLogging(user)); ``` ### Safe Error Messages ```typescript // ❌ WRONG - Leaking system information try { await db.execute(query); } catch (error) { return NextResponse.json({ error: error.message, // Might expose SQL, file paths, etc. stack: error.stack // NEVER expose in production }, { status: 500 }); } // ✅ CORRECT - Generic error with logging try { await db.execute(query); } catch (error) { console.error('Database error:', error); // Log full error internally return NextResponse.json({ error: "An error occurred processing your request" }, { status: 500 }); } ``` --- ## Logging ### Security Event Logging ```typescript enum SecurityEvent { AUTH_FAILURE = 'auth_failure', UNAUTHORIZED_ACCESS = 'unauthorized_access', PERMISSION_DENIED = 'permission_denied', RATE_LIMIT_EXCEEDED = 'rate_limit_exceeded', INVALID_INPUT = 'invalid_input' } function logSecurityEvent(event: SecurityEvent, details: any) { console.log(JSON.stringify({ timestamp: new Date().toISOString(), event, userId: details.userId || 'anonymous', ip: details.ip, endpoint: details.endpoint, details: sanitizeForLogging(details) })); } // Usage export async function GET(request: Request) { const { userId } = await auth(); if (!userId) { logSecurityEvent(SecurityEvent.AUTH_FAILURE, { ip: request.headers.get('x-forwarded-for'), endpoint: request.url }); return NextResponse.json({ error: "Unauthorized" }, { status: 401 }); } } ``` ### Request Tracing ```typescript import { v4 as uuidv4 } from 'uuid'; export async function middleware(request: Request) { const requestId = uuidv4(); console.log(JSON.stringify({ requestId, method: request.method, url: request.url, timestamp: new Date().toISOString() })); // Pass request ID through headers const response = await fetch(request.url, { headers: { ...request.headers, 'X-Request-ID': requestId } }); return response; } ``` --- ## Example Secure Endpoint ### Complete Next.js API Route ```typescript import { auth } from '@clerk/nextjs'; import { NextResponse } from 'next/server'; import { db } from '@/lib/db'; import { eq, and } from 'drizzle-orm'; import { z } from 'zod'; import { ratelimit } from '@/lib/ratelimit'; // 1. Input validation schema const updateResourceSchema = z.object({ name: z.string().min(1).max(100), description: z.string().max(500).optional(), isPublic: z.boolean().optional() }); // 2. DTO for safe output interface ResourceDTO { id: string; name: string; description: string; isPublic: boolean; createdAt: Date; } function toResourceDTO(resource: any): ResourceDTO { return { id: resource.id, name: resource.name, description: resource.description, isPublic: resource.isPublic, createdAt: resource.createdAt // Exclude: ownerId, internalNotes, etc. }; } export async function PATCH( request: Request, { params }: { params: { id: string } } ) { try { // 3. Rate limiting const { success } = await ratelimit.limit(request.headers.get('x-forwarded-for') || 'anonymous'); if (!success) { return NextResponse.json({ error: "Too many requests" }, { status: 429 }); } // 4. Authentication const { userId } = await auth(); if (!userId) { console.log('Auth failure:', { endpoint: request.url }); return NextResponse.json({ error: "Unauthorized" }, { status: 401 }); } // 5. Input validation const body = await request.json(); const result = updateResourceSchema.safeParse(body); if (!result.success) { return NextResponse.json({ error: "Validation failed", details: result.error.issues }, { status: 400 }); } // 6. Fetch and verify existence const resource = await db.query.resources.findFirst({ where: eq(resources.id, params.id) }); if (!resource) { return NextResponse.json({ error: "Not found" }, { status: 404 }); } // 7. Authorization check if (resource.ownerId !== userId) { console.log('Permission denied:', { userId, resourceId: params.id }); return NextResponse.json({ error: "Forbidden" }, { status: 403 }); } // 8. Update resource const [updatedResource] = await db.update(resources) .set({ ...result.data, updatedAt: new Date() }) .where(eq(resources.id, params.id)) .returning(); // 9. Return safe response return NextResponse.json(toResourceDTO(updatedResource)); } catch (error) { // 10. Safe error handling console.error('Error updating resource:', error); return NextResponse.json({ error: "An error occurred" }, { status: 500 }); } } ``` --- ## Framework Patterns ### Express.js Middleware Pattern ```typescript import { Request, Response, NextFunction } from 'express'; import { z } from 'zod'; // Validation middleware factory function validateSchema(schema: z.ZodSchema) { return (req: Request, res: Response, next: NextFunction) => { const result = schema.safeParse(req.body); if (!result.success) { return res.status(400).json({ error: 'Validation failed', details: result.error.issues }); } req.body = result.data; next(); }; } // Authorization middleware async function requireOwnership(req: Request, res: Response, next: NextFunction) { const resource = await db.resources.findById(req.params.id); if (!resource) { return res.status(404).json({ error: 'Not found' }); } if (resource.ownerId !== req.user.id) { return res.status(403).json({ error: 'Forbidden' }); } req.resource = resource; next(); } // Usage const updateSchema = z.object({ name: z.string() }); app.patch('/api/resources/:id', authenticate, validateSchema(updateSchema), requireOwnership, async (req, res) => { // All checks passed const updated = await updateResource(req.resource, req.body); res.json(toDTO(updated)); } ); ``` ### FastAPI Dependency Injection ```python from fastapi import Depends, HTTPException from typing import Annotated async def verify_ownership( resource_id: str, current_user: User = Depends(get_current_user) ): resource = await db.resources.get(resource_id) if not resource: raise HTTPException(status_code=404, detail="Not found") if resource.owner_id != current_user.id: raise HTTPException(status_code=403, detail="Forbidden") return resource @app.patch("/api/resources/{resource_id}") async def update_resource( data: UpdateResourceSchema, resource: Resource = Depends(verify_ownership) ): # Resource ownership verified updated = await resource.update(data.dict()) return ResourceDTO.from_orm(updated) ``` --- ## Common Vulnerabilities ### OWASP Top 10 API Security #### 1. Broken Object Level Authorization (BOLA) ```typescript // ❌ VULNERABLE export async function GET(request: Request) { const { userId } = await auth(); const resourceId = new URL(request.url).searchParams.get('id'); // Missing ownership check! const resource = await db.query.resources.findFirst({ where: eq(resources.id, resourceId) }); return NextResponse.json(resource); } // ✅ FIXED export async function GET(request: Request) { const { userId } = await auth(); const resourceId = new URL(request.url).searchParams.get('id'); const resource = await db.query.resources.findFirst({ where: and( eq(resources.id, resourceId), eq(resources.ownerId, userId) // Ownership check ) }); if (!resource) { return NextResponse.json({ error: "Not found" }, { status: 404 }); } return NextResponse.json(resource); } ``` #### 2. Mass Assignment ```typescript // ❌ VULNERABLE - User can set any field export async function PATCH(request: Request) { const body = await request.json(); // User could send: { role: 'admin', isVerified: true } await db.update(users) .set(body) // DANGEROUS! .where(eq(users.id, userId)); } // ✅ FIXED - Explicit allowed fields const allowedFields = z.object({ name: z.string().optional(), bio: z.string().optional() // role, isVerified NOT allowed }); export async function PATCH(request: Request) { const body = await request.json(); const validated = allowedFields.parse(body); await db.update(users) .set(validated) .where(eq(users.id, userId)); } ``` #### 3. Excessive Data Exposure ```typescript // ❌ VULNERABLE return NextResponse.json(user); // All fields exposed // ✅ FIXED return NextResponse.json({ id: user.id, name: user.name, email: user.email // passwordHash, resetToken, etc. excluded }); ``` #### 4. Rate Limiting ```typescript import { Ratelimit } from '@upstash/ratelimit'; import { Redis } from '@upstash/redis'; const ratelimit = new Ratelimit({ redis: Redis.fromEnv(), limiter: Ratelimit.slidingWindow(10, '10 s'), }); export async function POST(request: Request) { const identifier = request.headers.get('x-forwarded-for') || 'anonymous'; const { success } = await ratelimit.limit(identifier); if (!success) { return NextResponse.json({ error: "Too many requests" }, { status: 429 }); } // Process request... } ``` --- ## Summary ### Security Checklist Template ```markdown ## Security Review for [Endpoint Name] ### Authentication - [ ] User identity verified before processing - [ ] Invalid tokens rejected with 401 - [ ] Token expiration checked ### Authorization - [ ] Resource ownership verified - [ ] Role/permission checks implemented - [ ] Cross-tenant data isolation enforced ### Input Validation - [ ] All inputs validated with schema (Zod/Pydantic) - [ ] File uploads size/type limited - [ ] SQL injection prevented (using ORM) - [ ] XSS prevention in place ### Output Safety - [ ] Sensitive fields excluded from responses - [ ] PII masked in logs - [ ] Error messages don't leak system info ### Rate Limiting - [ ] Rate limits configured per endpoint - [ ] DDoS protection in place ### Logging - [ ] Failed auth attempts logged - [ ] Permission denials logged - [ ] Request IDs for traceability ``` Use this skill during code reviews and before deploying API changes to ensure comprehensive security coverage. --- Source attribution: David-Li0406 Original project: https://github.com/David-Li0406/meta-skill-evloving/blob/ca3a335628981df10c36e00cb9850df2c247ab9a/skill-flow/data/skills-refined-36k/skillsmp/api-security-review/SKILL.md License: Apache-2.0 License information: https://www.apache.org/licenses/LICENSE-2.0 Original upstream instructions; downloaded from Mega AI Hub. ## Upstream license notice Apache License Version 2.0, January 2004 http://www.apache.org/licenses/ TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION 1. Definitions. "License" shall mean the terms and conditions for use, reproduction, and distribution as defined by Sections 1 through 9 of this document. "Licensor" shall mean the copyright owner or entity authorized by the copyright owner that is granting the License. "Legal Entity" shall mean the union of the acting entity and all other entities that control, are controlled by, or are under common control with that entity. For the purposes of this definition, "control" means (i) the power, direct or indirect, to cause the direction or management of such entity, whether by contract or otherwise, or (ii) ownership of fifty percent (50%) or more of the outstanding shares, or (iii) beneficial ownership of such entity. "You" (or "Your") shall mean an individual or Legal Entity exercising permissions granted by this License. "Source" form shall mean the preferred form for making modifications, including but not limited to software source code, documentation source, and configuration files. "Object" form shall mean any form resulting from mechanical transformation or translation of a Source form, including but not limited to compiled object code, generated documentation, and conversions to other media types. "Work" shall mean the work of authorship, whether in Source or Object form, made available under the License, as indicated by a copyright notice that is included in or attached to the work (an example is provided in the Appendix below). "Derivative Works" shall mean any work, whether in Source or Object form, that is based on (or derived from) the Work and for which the editorial revisions, annotations, elaborations, or other modifications represent, as a whole, an original work of authorship. For the purposes of this License, Derivative Works shall not include works that remain separable from, or merely link (or bind by name) to the interfaces of, the Work and Derivative Works thereof. "Contribution" shall mean any work of authorship, including the original version of the Work and any modifications or additions to that Work or Derivative Works thereof, that is intentionally submitted to Licensor for inclusion in the Work by the copyright owner or by an individual or Legal Entity authorized to submit on behalf of the copyright owner. For the purposes of this definition, "submitted" means any form of electronic, verbal, or written communication sent to the Licensor or its representatives, including but not limited to communication on electronic mailing lists, source code control systems, and issue tracking systems that are managed by, or on behalf of, the Licensor for the purpose of discussing and improving the Work, but excluding communication that is conspicuously marked or otherwise designated in writing by the copyright owner as "Not a Contribution." "Contributor" shall mean Licensor and any individual or Legal Entity on behalf of whom a Contribution has been received by Licensor and subsequently incorporated within the Work. 2. Grant of Copyright License. Subject to the terms and conditions of this License, each Contributor hereby grants to You a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare Derivative Works of, publicly display, publicly perform, sublicense, and distribute the Work and such Derivative Works in Source or Object form. 3. Grant of Patent License. Subject to the terms and conditions of this License, each Contributor hereby grants to You a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable (except as stated in this section) patent license to make, have made, use, offer to sell, sell, import, and otherwise transfer the Work, where such license applies only to those patent claims licensable by such Contributor that are necessarily infringed by their Contribution(s) alone or by combination of their Contribution(s) with the Work to which such Contribution(s) was submitted. If You institute patent litigation against any entity (including a cross-claim or counterclaim in a lawsuit) alleging that the Work or a Contribution incorporated within the Work constitutes direct or contributory patent infringement, then any patent licenses granted to You under this License for that Work shall terminate as of the date such litigation is filed. 4. Redistribution. You may reproduce and distribute copies of the Work or Derivative Works thereof in any medium, with or without modifications, and in Source or Object form, provided that You meet the following conditions: (a) You must give any other recipients of the Work or Derivative Works a copy of this License; and (b) You must cause any modified files to carry prominent notices stating that You changed the files; and (c) You must retain, in the Source form of any Derivative Works that You distribute, all copyright, patent, trademark, and attribution notices from the Source form of the Work, excluding those notices that do not pertain to any part of the Derivative Works; and (d) If the Work includes a "NOTICE" text file as part of its distribution, then any Derivative Works that You distribute must include a readable copy of the attribution notices contained within such NOTICE file, excluding those notices that do not pertain to any part of the Derivative Works, in at least one of the following places: within a NOTICE text file distributed as part of the Derivative Works; within the Source form or documentation, if provided along with the Derivative Works; or, within a display generated by the Derivative Works, if and wherever such third-party notices normally appear. The contents of the NOTICE file are for informational purposes only and do not modify the License. You may add Your own attribution notices within Derivative Works that You distribute, alongside or as an addendum to the NOTICE text from the Work, provided that such additional attribution notices cannot be construed as modifying the License. You may add Your own copyright statement to Your modifications and may provide additional or different license terms and conditions for use, reproduction, or distribution of Your modifications, or for any such Derivative Works as a whole, provided Your use, reproduction, and distribution of the Work otherwise complies with the conditions stated in this License. 5. Submission of Contributions. Unless You explicitly state otherwise, any Contribution intentionally submitted for inclusion in the Work by You to the Licensor shall be under the terms and conditions of this License, without any additional terms or conditions. Notwithstanding the above, nothing herein shall supersede or modify the terms of any separate license agreement you may have executed with Licensor regarding such Contributions. 6. Trademarks. This License does not grant permission to use the trade names, trademarks, service marks, or product names of the Licensor, except as required for reasonable and customary use in describing the origin of the Work and reproducing the content of the NOTICE file. 7. Disclaimer of Warranty. Unless required by applicable law or agreed to in writing, Licensor provides the Work (and each Contributor provides its Contributions) on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied, including, without limitation, any warranties or conditions of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A PARTICULAR PURPOSE. You are solely responsible for determining the appropriateness of using or redistributing the Work and assume any risks associated with Your exercise of permissions under this License. 8. Limitation of Liability. In no event and under no legal theory, whether in tort (including negligence), contract, or otherwise, unless required by applicable law (such as deliberate and grossly negligent acts) or agreed to in writing, shall any Contributor be liable to You for damages, including any direct, indirect, special, incidental, or consequential damages of any character arising as a result of this License or out of the use or inability to use the Work (including but not limited to damages for loss of goodwill, work stoppage, computer failure or malfunction, or any and all other commercial damages or losses), even if such Contributor has been advised of the possibility of such damages. 9. Accepting Warranty or Additional Liability. While redistributing the Work or Derivative Works thereof, You may choose to offer, and charge a fee for, acceptance of support, warranty, indemnity, or other liability obligations and/or rights consistent with this License. However, in accepting such obligations, You may act only on Your own behalf and on Your sole responsibility, not on behalf of any other Contributor, and only if You agree to indemnify, defend, and hold each Contributor harmless for any liability incurred by, or claims asserted against, such Contributor by reason of your accepting any such warranty or additional liability. END OF TERMS AND CONDITIONS APPENDIX: How to apply the Apache License to your work. To apply the Apache License to your work, attach the following boilerplate notice, with the fields enclosed by brackets "[]" replaced with your own identifying information. (Don't include the brackets!) The text should be enclosed in the appropriate comment syntax for the file format. We also recommend that a file or class name and description of purpose be included on the same "printed page" as the copyright notice for easier identification within third-party archives. Copyright [yyyy] [name of copyright owner] Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at http://www.apache.org/licenses/LICENSE-2.0 Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License. # Mega AI Hub resource metadata Creator / publisher: David-Li0406 Original project: https://github.com/David-Li0406/meta-skill-evloving/blob/ca3a335628981df10c36e00cb9850df2c247ab9a/skill-flow/data/skills-refined-36k/skillsmp/api-security-review/SKILL.md Attribution basis: Source repository record Fields of work: Development & Engineering, Product Management Roles: Backend Developer, DevOps / SRE, Product Manager, Security Engineer, Technical Product Manager Specialties: API, Backend Tools: Clerk, Django, Fastapi, Jsonwebtoken Country applicability: Country not specified Classification basis: Source catalog labels Instruction SHA-256: 5df931479ef0dae5e1edea638de7e434bed493856f13343e59984b2f5db83d98