Coffee, Chaos and ProdSec Ep 20 - API Security - Shadows, Zombies, and Other APIs We Pretend Don't Exist
Jan 14, 2026
They tour API security nightmares like unauthenticated endpoints and broken authorization that let attackers roam freely. The conversation digs into shadow and zombie APIs nobody remembers and why inventories keep failing. They unpack AI-driven scanners, MCP/LLM broker risks, and the limits of traditional DAST. Practical fixes and urgency around inventory, docs, and continuous testing come up throughout.
AI Snips
Chapters
Transcript
Episode notes
A Single Character Exposed Data
- Kurt changed a single ID in an internal API and retrieved data he shouldn't have seen.
- That simple character tweak exposed how easy broken authorization can leak whole datasets.
Authenticate And Authorize Every Call
- Authenticate every API call and never rely on a perimeter assumption.
- Implement authorization checks for each request, not just initial authentication.
Obscurity Is Not A Defense
- Security through obscurity fails because attackers and automation find hidden endpoints quickly.
- Public IPs and forgotten APIs get probed within minutes, so hidden equals vulnerable.