# Deprecated / Unprotected API Versions

> Detects old API versions that may lack current security controls and deprecated endpoints still accessible in production.

- Skill: `zakirkun/deprecated-unprotected-api-versions` (Agent Skill, multi-file: 2 files)
- Install (CLI): `npx skillmds@latest add zakirkun/deprecated-unprotected-api-versions`
- Raw SKILL.md: https://api.skillmd.com/api/skills/zakirkun/deprecated-unprotected-api-versions/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Security
- Author: zakirkun (https://skillmd.com/u/zakirkun)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/zakirkun/deprecated-unprotected-api-versions

---


# Deprecated / Unprotected API Versions

## Overview
Old API versions are a common attack vector because:
- They often lack security controls added in newer versions
- Authentication requirements may differ between v1 and v2
- They may expose endpoints removed from newer versions for security reasons
- Rate limiting and input validation may not apply to legacy versions

## Detection Strategy
- Old API version routes (`/v1/`, `/v0/`) served alongside newer versions
- Deprecated endpoint paths still registered in routing
- Different authentication middleware applied to different version prefixes

## Remediation
- Maintain a clear API deprecation policy with sunset dates
- Apply the same security controls to all active API versions
- Log and monitor usage of deprecated endpoints
- Return HTTP 410 (Gone) for fully deprecated versions