--- title: "#apisecurity articles | Hashnode" description: "Explore 31 articles tagged #apisecurity on Hashnode. Tutorials, guides, and how-tos from the community." url: "https://hashnode.com/tag/apisecurity" --- Tag # #apisecurity 31 posts · 5 followers [Oluwaseyi Fatunmole](https://hashnode.com/@foluwaseyi) · [Oct 15](https://hashnode.com/posts/secure-by-design-engineer-security-into-architecture-before-writing-code/6ad05dd81f613b7136df1683) ### [Secure by Design: How to Engineer Security into Architecture Before Writing Any Code](https://freecodecamp.org/news/secure-by-design-engineer-security-into-architecture-before-writing-code?utm_source=hashnode&utm_medium=feed) There's a conversation that happens in most engineering teams,maybe usually too late. Think of this, a feature ships to production. A security review happens afterwards, or a penetration test finds so 32 min read · [freecodecamp.org](https://freecodecamp.org/news/secure-by-design-engineer-security-into-architecture-before-writing-code?utm_source=hashnode&utm_medium=feed) [ZyVOP](https://hashnode.com/@zyvop) · [Sep 25](https://hashnode.com/posts/rate-limiting-alone-wont-stop-a-patient-attacker/6ab6a66e937c16b49c2559cf) ### [Rate Limiting Alone Won't Stop a Patient Attacker](https://blog.zyvop.com/rate-limiting-alone-wont-stop-a-patient-attacker?utm_source=hashnode&utm_medium=feed) @nestjs/throttler counts requests per IP. It has no idea what an account is. Here's what that gap actually looks like, and the Redis-backed lockout that closes it. 8 min read · [blog.zyvop.com](https://blog.zyvop.com/rate-limiting-alone-wont-stop-a-patient-attacker?utm_source=hashnode&utm_medium=feed) [ZyVOP](https://hashnode.com/@zyvop) · [Sep 25](https://hashnode.com/posts/four-ways-a-refresh-token-request-fails-only-one-means-trouble/6ab6a5dd5f8e716096ebe6d8) ### [Four Ways a Refresh Token Request Fails — Only One Means Trouble](https://blog.zyvop.com/four-ways-a-refresh-token-request-fails-only-one-means-trouble?utm_source=hashnode&utm_medium=feed) Invalid, expired, revoked, and reused tokens aren't the same. Build real refresh token reuse detection in NestJS + Postgres—and verify it revokes only the compromised session. 9 min read · [blog.zyvop.com](https://blog.zyvop.com/four-ways-a-refresh-token-request-fails-only-one-means-trouble?utm_source=hashnode&utm_medium=feed) [Sandra Sydney](https://hashnode.com/@sandysyndy) · [Aug 24](https://hashnode.com/posts/tier-1-soc-playbook-detecting-and-containing-ddos-mass-assignment-attacks-using-nist-sp-800-61/6a8c735dbe51e3e4d00e436c) ### [Tier-1 SOC Playbook: Detecting and Containing DDoS & Mass Assignment Attacks using NIST SP 800-61](https://sandrasydney.hashnode.dev/tier-1-soc-playbook-detecting-and-containing-ddos-mass-assignment-attacks-using-nist-sp-800-61?utm_source=hashnode&utm_medium=feed) SOC incident response playbook for containing REST API mass assignment vulnerabilities using NIST SP 800-61. 3 min read · [sandrasydney.hashnode.dev](https://sandrasydney.hashnode.dev/tier-1-soc-playbook-detecting-and-containing-ddos-mass-assignment-attacks-using-nist-sp-800-61?utm_source=hashnode&utm_medium=feed) [Sandra Sydney](https://hashnode.com/@sandysyndy) · [Aug 24](https://hashnode.com/posts/developer-integration-manual-secure-firewall-rest-api-gateway/6a8c7b6b04c8839bdf9b4e92) ### [Developer Integration Manual: Secure Firewall REST API Gateway](https://sandrasydney.hashnode.dev/developer-integration-manual-secure-firewall-rest-api-gateway?utm_source=hashnode&utm_medium=feed) Complete guide to JWT authentication, security headers, schema validation, and error resolution for REST API integration. 2 min read · [sandrasydney.hashnode.dev](https://sandrasydney.hashnode.dev/developer-integration-manual-secure-firewall-rest-api-gateway?utm_source=hashnode&utm_medium=feed) [contact](https://hashnode.com/@pykero) · [Aug 23](https://hashnode.com/posts/rate-limiting-ai-features-stop-one-user-from-draining-your-budget/6a8a592685c446430195f5fe) ### [Rate Limiting AI Features: Stop One User From Draining Your Budget](https://pykero.hashnode.dev/rate-limiting-ai-features-stop-one-user-from-draining-your-budget?utm_source=hashnode&utm_medium=feed) Learn how to rate-limit AI features so a single user, bot, or bug can't blow your LLM budget. Practical patterns for founders and CTOs shipping AI products. 6 min read · [pykero.hashnode.dev](https://pykero.hashnode.dev/rate-limiting-ai-features-stop-one-user-from-draining-your-budget?utm_source=hashnode&utm_medium=feed) [Devy Jones](https://hashnode.com/@devmachive) · [Jul 28](https://hashnode.com/posts/finding-exposed-apis-and-services-a-practical-guide-for-developers-with-scansearch-ms44o60g/6a68295a6284cfca6d65bb87) ### [Finding Exposed APIs and Services: A Practical Guide for Developers (with ScanSearch)](https://devyjones.hashnode.dev/finding-exposed-apis-and-services-a-practical-guide-for-developers-with-scansearch-ms44o60g?utm_source=hashnode&utm_medium=feed) As developers, we're constantly building and deploying services, often exposing APIs to the internet. While necessary, this exposure brings a critical responsibility: ensuring these endpoints are secu 5 min read · [devyjones.hashnode.dev](https://devyjones.hashnode.dev/finding-exposed-apis-and-services-a-practical-guide-for-developers-with-scansearch-ms44o60g?utm_source=hashnode&utm_medium=feed) [Prajapati Paresh](https://hashnode.com/@iprajapatiparesh) · [Jul 8](https://hashnode.com/posts/stop-api-floods-redis-sliding-window-rate-limits/6a4dd059cd80e2bc3d0768be) ### [Stop API Floods: Redis Sliding Window Rate Limits ⚡](https://smarttechdevs.hashnode.dev/stop-api-floods-redis-sliding-window-rate-limits?utm_source=hashnode&utm_medium=feed) Prevent API traffic bursts and DDoS attacks. Learn how to architect a Redis Sliding Window rate limiter in Laravel using Sorted Sets. 3 min read · [smarttechdevs.hashnode.dev](https://smarttechdevs.hashnode.dev/stop-api-floods-redis-sliding-window-rate-limits?utm_source=hashnode&utm_medium=feed) [Manuela Schrittwieser](https://hashnode.com/@neuralstackms) · [Apr 9](https://hashnode.com/posts/secure-by-design-patterns-for-llm-backend-apis/69d76c88fa7251682e73447c) ### [Secure-by-Design Patterns for LLM-Backend APIs](https://neuralstackms.tech/secure-by-design-patterns-for-llm-backend-apis?utm_source=hashnode&utm_medium=feed) Standard API security is necessary but not sufficient when your backend is a large language model. LLMs introduce an entirely new attack surface one that lives inside the model's context window. This 14 min read · [neuralstackms.tech](https://neuralstackms.tech/secure-by-design-patterns-for-llm-backend-apis?utm_source=hashnode&utm_medium=feed) [6](https://hashnode.com/posts/secure-by-design-patterns-for-llm-backend-apis/69d76c88fa7251682e73447c) [Tanvi Londhe](https://hashnode.com/@Banjaarey25) · [Jan 8](https://hashnode.com/posts/travel-crm-deep-dive-architecture-integration-and-why-generic-solutions-fail/695fac23f3aa00a0b8517a25) ### [Travel CRM Deep Dive: Architecture, Integration, and Why Generic Solutions Fail](https://travel-techie.hashnode.dev/travel-crm-deep-dive-architecture-integration-and-why-generic-solutions-fail?utm_source=hashnode&utm_medium=feed) If you've ever worked with travel industry clients, you know they have... unique requirements. Multi-leg bookings spanning continents, complex supplier relationships, seasonal pricing madness, and customers who expect you to remember their hotel pill... 7 min read · [travel-techie.hashnode.dev](https://travel-techie.hashnode.dev/travel-crm-deep-dive-architecture-integration-and-why-generic-solutions-fail?utm_source=hashnode&utm_medium=feed)