padosoft-api-security-reviewlisted

# API security review Ten checks to run **before committing** a change to an API, and when reviewing a PR. Each one carries the mistake that produces it: these are failure modes that have been seen in production code, not items from a generic checklist. The complete rules, with identifiers and rationale, are in [`references/rules.md`](references/rules.md). Read it when a check fires and you need the full reasoning, or when you have to decide whether something is a real exception. --- ## 0. How to run it ```bash git diff --cached --name-only --diff-filter=ACMR | grep -E '\.(ts|js|mjs)$' # empty? then: git diff --name-only ``` Apply the relevant checks to those files. **For every violation: block the commit**, name the rule, propose the fix. Skip a check that does not apply to the diff — do not report it as passed. **A pre-screen is a screen, not a verdict.** Each one is tuned to surface candidates, and a healthy codebase still produces hits: they are the compliant implementations of the very rule being checked. Where that happens, the check below shows what a compliant hit looks like — recognise it, say so in one line, move on. A check that reports 40 lines every time gets ignored, and then it protects nothing. Severity: a violation of checks 1, 2, 3 or 5 is **critical** — each of them is, on its own, enough to expose data or credentials. The others block the commit but can be discussed. --- ## 1. Auth on every mutating route — `API-SEC-AUTH-001` Every POST/PUT/PATC