api-securitylisted

<!-- Native skill bundle for Claude Code. Generated by `secure-vibe dev regenerate`. --> <!-- Do not edit by hand; the source of truth is skills/api-security/SKILL.md. --> # API Security Apply OWASP API Top 10 patterns to authentication, authorization, and input validation ## ALWAYS - Require authentication on every non-public endpoint. Default to authenticated; opt out for genuinely public routes by explicit annotation. - Apply authorization at the object level — confirm the authenticated subject actually has access to the requested resource ID, not just that they're logged in (defeats the OWASP API1 BOLA / IDOR class). - Bind object-level authz to the **gateway-authenticated principal**, never to an actor id echoed in the request: a check that a request-supplied `senderId`/`ownerId`/`actedBy` is a valid member validates the *claimed* actor, not the caller (looks like authz, isn't). - On `/{scopeId}/.../{subjectId}` routes, authorize the *relationship* — confirm the subject belongs to that scope; a caller-vs-scope check alone does not authorize the subject (multi-key BOLA). - Authorize **each subject on streaming responses** (SSE/chunked/WebSocket): the `200` is committed before the handler runs, so an empty/filtered stream — not a `4xx` — is the deny signal; an unauthorized subject gets zero events. - Validate all request inputs against an explicit schema (JSON Schema, Pydantic, Zod, validator/v10 struct tags). Reject early; never propagate untrusted input deeper. - Enf