Summary

We covered a lot in this chapter and, hopefully, you have a sense of optimism about the benefits of a shift-left approach toward API security. By embracing a design-first approach, development teams can incorporate security and data directives into their design at the very outset. By leveraging the OpenAPI definition as the single source of truth, developers can drive their development processes using API auditing and testing tools. The main benefit of this contract-based approach is the positive security model—no longer guessing what bad data looks like, we only allow good data. A predictor of success in the driving of a modern API development process is the tight integration of tools into the CI/CD pipelines, allowing the complete automation of the build, test, and deployment processes. Many of the most common vulnerabilities in APIs can be easily detected automatically and eliminated entirely—this is the essence of the shift-left approach. Finally, incorporating...