DedSec Security Research · 2026-10-17
Most data now leaves an organisation through an API, and most of the APIs that leak were not on anyone's list. That is the uncomfortable centre of API security: the failures that dominate breaches are not exotic payloads, they are authorization gaps on endpoints nobody was testing.
Broken object-level authorization — BOLA, the top entry on the OWASP API Security list — is as simple as it is common. An endpoint returns an object by id: \