API Security Review

Perform comprehensive API security assessment following plays/api-security-review.md.

Steps

1. Discovery & Reconnaissance

   • Parse OpenAPI/Swagger specs or scan code for endpoints
   • Identify authentication mechanisms (JWT, OAuth 2.0, API keys, mTLS)
   • Map API gateway and middleware configurations
   • Enumerate all API versions and deprecated endpoints

2. Authentication Deep Dive

   • JWT security (algorithm confusion, weak signing, token expiration)
   • OAuth 2.0 flows (PKCE, state parameter, redirect URI validation)
   • API key exposure and rotation policies
   • Session management and token storage