Shift left is a software development approach that builds security into an API from design onward instead of waiting until deployment to test for vulnerabilities. Earlier checks shorten the feedback loop, reduce costly redesign, and support faster, more confident releases. section 1.2 section 3.1
Apply shift-left security throughout the development lifecycle:
- Assess vulnerabilities during API design, including unsafe user flows, exposed server-side properties, unconstrained input, and sensitive data exposure. section 3.0 section 6.0
- Use accurate API specifications, secure implementation patterns, validation libraries, and automated tests for access controls. section 3.1 section 3.0
- Treat failed security tests as feedback: address the vulnerability before moving to the next development stage. section 3.7
Designing away property enumeration
An API exposes a server-side stock property that lets users sort products by available stock. An attacker can use that information to target scarce products in a scalping attack. A late, bolt-on fix might patch SQL injection with a regular expression while leaving property enumeration exposed. A design-level fix constrains sortable values with an enumeration, addressing both risks by design.
