Every API is a public attack surface, and the failures repeat with remarkable consistency. Broken object-level authorization, broken authentication, unrestricted resource consumption, injection: the OWASP API Security Top 10 is the industry's record of what actually gets exploited, not what theoretically could be.

This talk walks the whole list. For each item: what the flaw looks like in real code, how an attacker reaches it, and the specific mitigation, from authorization checks that belong at the object level rather than the route, to rate limiting and schema validation at the edge.

You'll leave able to audit your own APIs against the list, and knowing which entries deserve your attention first.