APIs are where modern applications actually live — and where most of the interesting findings come from. Across engagements, the same patterns recur with remarkable consistency.
Broken Object Level Authorization
The single most common API vulnerability. An endpoint like GET /api/invoices/1042 checks that you're logged in, but not that invoice 1042 belongs to you. Sequential IDs make it trivially exploitable; UUIDs merely make it less discoverable, not less broken.
Excessive Data Exposure
The endpoint returns the full database object and trusts the client to display only what's needed. Internal flags, other users' email addresses, and soft-deleted records all end up one curl away.
Unprotected Non-Production Environments
Staging APIs with production data, debug endpoints left enabled, or v1 routes kept alive "temporarily" after v2 shipped. Attack surface you've forgotten about is attack surface you're not defending.
What To Do
Enforce authorization at the object level in one place, return explicit response schemas rather than raw models, and inventory every deployed environment. Then test continuously — API surface changes with every release.