Secure and Compliant APIs - By Design
summary
Adds a missing market-level authorization check to a .NET products API, proves the bug with unit and system tests, and then automates detection by feeding a one-line access model and API-specific MD instructions to Copilot custom agents. Builds an MCP server with RAG indexes to limit hallucinations and maps controls to ASVS (≈350 verifications reduced to ~50 then eight PR questions). Prototype finds BOLA/IDOR reliably for well-structured repos but still requires humans-in-loop for drift and hallucinations.
AI-written summary · about
chapters (12)
- 0:00Secure API development
- 9:35Security review process limits
- 11:43Security by design challenges
- 13:04Secure API review checklist
- 18:40AI agents for security reviews
- 25:42AI agents with security context
- 29:16Compliance requirements to code
- 33:55AI in development workflow
- 38:11Security MCP server architecture
- 41:02Key takeaways and recommendations
- 45:18Scaling security automation
- 47:29Q&A
related talks
46mAPI Security – Divide & Conquer
26mGovernance and Security of APIs and MCPs
39mAPI Security: Acting Now to Enable Security Controls
24mMastering API Security: From Design to Deployment
48mNavigating the depths of API security testing
14mGoing beyond AppSec integration, correlation, and orchestration
33mImproving API Security Posture.
52mAI Agents Need Permission Slips