Web Security Trends

API vulnerabilities are outpacing classic web bugs

Across recent engagements, broken object-level authorization and excessive data exposure in APIs show up more often than classic injection flaws. Modern applications expose far more API surface than they did five years ago, and testing hasn't always kept pace with that shift.

The fix isn't exotic: consistent authorization checks at the object level, and API responses trimmed to exactly what the client needs — not the full database row.

Deserialization risk is back, quietly

Insecure deserialization dropped off a lot of teams' radar after early 2010s frameworks patched their defaults. It's resurfacing in custom serialization layers built for microservice communication, where the same discipline hasn't been applied.

If your services pass serialized objects between each other, that boundary deserves the same scrutiny as a public-facing endpoint.

Client-side logic is doing more, and getting tested less

Single-page applications increasingly enforce business logic in the browser — validation, feature gating, even pricing calculations. Attackers just bypass the client and hit the API directly, and testing needs to assume they will.

Treat every client-side control as a UX nicety, not a security boundary, and verify the server enforces the same rule independently.