XTRIKE API SECURITY · PLATFORM 12
XTRIKE API DESK — Proof-Driven API Security
Launch API Scan
API Security Posture & Proof GovernanceGateway: api.acme.com/v2 · commit: 9f4c2a1e

Enterprise API Triage & Proof-Driven Release Gates

Validation EngineNew API Scan
Indexed API Endpoints
83
REST, GraphQL & gRPC
Confirmed w/ 6-Point Proof
6
100% Replay Reproducible
Open / Resolved Triage
8 / 0
8 Total Tracked Alerts
API Mutation Catch Rate
95.0%
19/20 Seeded Mutants Caught
Release Quality Gates
6 / 6 PASS
Zero Unverified Confirmations
Showing 8 of 8 findings
API-001CriticalAPI1:2023 · CWE-639BOLA
Open

BOLA — User record access by manipulating ID

GET /api/v2/users/{id} · REST · Owner: API Team

Broken Object Level Authorization: any authenticated user can access any other user's data by changing the ID parameter.

Proof Status: 6-Point Contract Verified (commit 9f4c2a1e)
API-002CriticalAPI2:2023 · CWE-327JWT
Open

JWT 'none' algorithm accepted — Authentication bypass

GET /api/v2/admin/users · REST · Owner: Auth Team

The API accepts JWTs signed with alg:none, allowing attackers to forge tokens without a secret key.

Proof Status: 6-Point Contract Verified (commit 9f4c2a1e)
API-003CriticalAPI8:2023 · CWE-200Schema
Open

GraphQL introspection enabled in production

POST /api/graphql · GraphQL · Owner: API Team

GraphQL introspection is enabled allowing full schema discovery — all types, queries, mutations, and internal structures exposed.

Proof Status: 6-Point Contract Verified (commit 9f4c2a1e)
API-004HighAPI4:2023 · CWE-307Rate Limiting
Open

No rate limiting on authentication endpoint

POST /api/v2/auth/login · REST · Owner: Auth Team

The login endpoint accepts unlimited requests without throttling, lockout, or CAPTCHA.

Proof Status: 6-Point Contract Verified (commit 9f4c2a1e)
API-005HighAPI3:2023 · CWE-312Data Exposure
Open

Password hash returned in API response

GET /api/v2/admin/users/{id} · REST · Owner: API Team

The admin user detail endpoint includes the bcrypt password hash in the JSON response.

Proof Status: 6-Point Contract Verified (commit 9f4c2a1e)
API-006HighAPI6:2023 · CWE-915Mass Assignment
Open

Mass assignment allows privilege escalation

PUT /api/v2/users/{id} · REST · Owner: API Team

The user update endpoint binds all request properties including sensitive fields like is_admin and role.

Proof Status: 6-Point Contract Verified (commit 9f4c2a1e)
API-007HighAPI7:2023 · CWE-942CORS
Open

CORS — Origin reflection with credentials allowed

GET /api/v2/users/me · REST · Owner: API Team

The API reflects arbitrary Origin headers and sets Access-Control-Allow-Credentials: true.

Proof Status: 6-Point Contract Verified (commit 9f4c2a1e)
API-008MediumAPI9:2023 · CWE-200Schema
Open

Swagger UI exposes internal API endpoints in production

GET /api/swagger-ui · REST · Owner: DevOps

Interactive Swagger UI accessible in production exposes all endpoints including internal admin and debug routes.

Proof Status: 6-Point Contract Verified (commit 9f4c2a1e)
API-001 · API1:2023 (CWE-639)Critical

BOLA — User record access by manipulating ID

6-Point Proof Contract SummaryCONFIRMED (99%)
Missing `AND users.tenant_id = :jwt_tenant_id` in SQLAlchemy query
Controller: services/users/controllers/user_controller.py:L42–L68
Controlled HTTP Request Evidence
GET /api/v2/users/1001 HTTP/1.1
Host: api.acme.com
Authorization: Bearer <user_1000_token>
Observed HTTP Response Evidence
HTTP/1.1 200 OK

{"id":1001,"name":"Jane Smith","email":"jane@corp.com","ssn_last4":"7821","salary":94000}
Verified Engineering Remediation
Implement resource-level authorization. Verify authenticated user owns the resource. Use UUIDs instead of sequential IDs.

CI/CD API Release Quality Gates (6 / 6 PASS)

Inspect Gates →
GATE-01 · Zero Unverified Confirmations
0 unverified (6 / 6 CONFIRMED have full proof contracts)
PASS
GATE-02 · Role-Differential Replay Reproducibility
100.0% (18 / 18 replay probes matched status & schema diff)
PASS
GATE-03 · Scanner False-Positive Suppression
API-009 (SQLi on bound parameter) downgraded with proof
PASS
GATE-04 · API Security Mutation Catch Rate
95.0% (19 / 20 seeded API security mutants caught)
PASS
GATE-05 · Commit SHA & OpenAPI 3.1 Digest Binding
100% bound (commit 9f4c2a1e · spec sha256:4b8e91c0...d32a)
PASS
GATE-06 · Executable Regression Contract Generation
6 / 6 CONFIRMED findings have CI-ready Pytest contracts
PASS