API Reviewer

Expert guidance for reviewing and securing Frappe API endpoints to prevent security vulnerabilities.

Overview

Frappe makes it easy to expose API endpoints using the @frappe.whitelist() decorator. However, this convenience can lead to security holes if proper permission checks aren't implemented. This skill helps identify and fix common API security issues.

Common Security Issues

The most common API security problems in Frappe applications:

1. Missing role validation: Endpoints accessible to any authenticated user
2. Using frappe.get_all instead of frappe.get_list: Bypassing permission checks
3. No document permission checks: Modifying records without validation
4. SQL injection: Unsafe query construction with user input
5. Unrestricted data access: Exposing sensitive information

See references/security-best-practices.md for detailed explanations and examples of each issue.