Application security, in the open
Where application security gets researched and taught.
Original research from apisec Labs, courses from apisec University, live events and masterclasses, and open-source tools. Pick a view to see what's here for you.
One changed number exposes another customer's data.
- WHAT HAPPENS
- A signed-in user changes an ID in a request and reads records that belong to a different customer. The application never checks who owns them.
- WHY IT MATTERS
- Broken object-level authorization is the top risk on the OWASP API Security list, and code review rarely catches it.
- ASK YOUR TEAM
- Do we test every endpoint for ownership checks, on every release, and can we show the evidence?
Signed in as user_a · tenant A · account 1041
This endpoint returns your own account. Send it, then change the ID to someone else's.
// response appears hereRESULT not tested yet
NO PROOF YET- 01
API Security Fundamentals
How APIs work, how they break, and the controls that matter. Free, with a certificate.
- 02
OWASP API Security Top 10 and Beyond
Where you learn the flaw practitioners exploit in the lab, with real exploits and fixes.
- 03
Certification, then masterclasses
A credential employers can verify, then live, hands-on masterclasses when you're ready.
Courses for every level, from your first API to advanced pentesting.
150,000+ security professionals have trained with apisec University. Free courses, certifications employers can verify, and live, hands-on masterclasses.
API Security Fundamentals
How APIs work, how they break, and the controls that matter.
INTERMEDIATE · [X] HRSOWASP API Security Top 10 and Beyond
Each risk class, with real exploits and the fixes that stop them.
ADVANCED · [X] HRSAPI Penetration Testing
Hands-on methodology for authorization flaws and business logic abuse.
ADVANCED · [X] HRS[AI and MCP security course]
Testing agents, MCP servers and LLM call sites in real applications.
A working map of how applications actually break.
Every point is a finding published by apisec Labs. Pick a territory for the leadership brief, or a point for the research, the course that goes deeper and the tool that finds it.