api-securitylisted

<!-- Native skill bundle for Claude Code. Generated by `secure-vibe dev regenerate`. --> <!-- Do not edit by hand; the source of truth is skills/api-security/SKILL.md. --> # API Security OWASP API Top 10 for HTTP, GraphQL, and gRPC endpoints: input validation, route rate limiting, mass assignment, response caching, and gateway-versus-service control placement. Use when generating or reviewing HTTP handlers, GraphQL resolvers, gRPC service methods, or any API endpoint change. ## ALWAYS - Require authentication on every non-public endpoint. Default to authenticated; opt out for genuinely public routes by explicit annotation. - Consult `auth-security` for **who the caller is and what they may touch**. It owns the credential (algorithm pinning, expiry, lifetime, session, CSRF) and the permission (object-level BOLA/IDOR checks, multi-key routes, streaming subjects, function-level role gating). Any endpoint that reads or writes a resource by id needs it; this skill covers everything else about the endpoint. - Validate all request inputs against an explicit schema (JSON Schema, Pydantic, Zod, validator/v10 struct tags). Reject early; never propagate untrusted input deeper. - Enforce rate limits at the route level for authentication endpoints, password reset, and any expensive operation. - Consult `error-handling-security` for what an error response may carry. It owns the boundary between what crosses to the client and what stays in the log, including presence-of-record disclosur