Identify who is calling the API and what they are allowed to do.
: Limit the number of calls a single API key or IP address can make per minute/hour. API CheatSquad
Never trust incoming data. A solid feature strictly validates every field to prevent common attacks like SQL Injection or Cross-Site Scripting (XSS) . Identify who is calling the API and what
A feature is only "solid" if others can use it correctly without constant help. API CheatSquad