REST APIs in SMBs: holes your mobile app exposes
The client mobile app looks great; the API behind it sometimes trusts obscurity. OWASP API Security Top 10 applied to LatAm reality.
Many SMBs in Puerto Rico launched mobile apps during the pandemic — orders, appointments, inventory. The frontend passed App Store review; the API on a small EC2 was forgotten. OWASP API Security Top 10 exists because this is universal: BOLA (access to other users' objects), broken authentication, and missing rate limiting.
We start audits with three simple tests: can I change an ID
We start audits with three simple tests: can I change an ID in the URL and see another customer's data? Do JWT tokens expire and revoke on logout? Is there throttling per IP and per user? Failing any is an incident waiting for peak hour.
Do not reinvent OAuth: use proven providers or maintained libraries
Do not reinvent OAuth: use proven providers or maintained libraries. Storing API keys in the mobile binary is inevitable for some cases — compensate with short-lived keys, certificate pinning where applicable, and minimal scopes. Google Security Blog has covered abuse of poorly protected APIs in Android ecosystems; patterns apply equally if your backend is in San Juan.
Logging and alerts on financial or PHI APIs: every denied access, every 401/403 spike, every anomalous latency. Without telemetry, your first breach indicator is an angry customer on social media.
Document versioning and deprecation. Changing a field without notice breaks partner integrations in the Caribbean that update slowly. Security includes clear contracts: what data is exposed, retention, and revocation when an integrator ends the business relationship.
Operations and execution — connecting strategy with what the team ships every week.
