Is a Public EKS API Endpoint Safe with a Strict IP Allowlist?
I run a central Argo CD instance in EKS using ApplicationSets to manage several EKS clusters over private networking. One additional cluster is in a separate account and…
API security
How should REST endpoints handle current-user and admin views of listings?
I'm building an app with a mobile client now and an admin dashboard planned for later. I have a listings resource, but different use cases return different DTOs:…
How can I safely host a personal BYOK web app online?
I built a personal web app for writing roleplay scenes. It uses BYOK (Bring Your Own Key) for services such as the database, and I would like to…
How should a solo developer manage third-party services for unrelated clients?
I'm trying to understand the real-world setup for third-party services such as Resend when one developer builds backends for several completely unrelated businesses. For example, one client is…
How to Improve API Security Testing in Production?
I'm currently facing some challenges with API security testing for our live REST and gRPC APIs. We rely on SAST during development, but once the APIs are deployed,…
How Do You Handle API Permissions Without Losing Your Mind?
I'm working on a project and I want to implement a solid access control system for my API. I've heard it can get pretty complicated, so I'm looking…
Best Practices for Managing Elevated Permissions in APIs
I'm developing an app and I'm facing some challenges with securing certain API endpoints that require elevated permissions, like admin actions. I'd like to understand the best practices…
How Can I Securely Integrate an API with My Website?
Hey everyone! I usually build custom WordPress themes in PHP based on designs from clients or external agencies, but I've recently encountered a challenge. I created a website…
Do I Need Row Level Security with Supabase if My API Handles Authentication?
I'm working on a web app using a Node.js backend and a React frontend, with Supabase/Postgres as my database. Right now, I'm using the Supabase service key in…