Broken API Versioning Security

Detects API versioning patterns where newer security controls do not apply to older API versions still in use.

zakirkun a4e04f2 2 files · 2.2 KB Updated

File contents

Broken API Versioning Security

Overview

When APIs evolve through versions, older versions often lack security controls added in newer versions:

  • Authentication may be optional in v1 but required in v2
  • Input validation may differ between versions
  • Rate limiting may only apply to newer API versions
  • Deprecated endpoints may expose functionality removed for security reasons

Remediation

  • Apply identical security controls to ALL active API versions
  • Use shared security middleware that applies to all version routes
  • Actively sunset old API versions with deprecation notices
  • Monitor and alert on old API version usage

zakirkun/ice-tea/tree/main/skills/api/broken-api-versioning commit a4e04f27a0

Frequently asked questions

npx skillmds@latest add zakirkun/broken-api-versioning-security