You finished API8 — Security Misconfiguration. Here’s what you now understand:
✓What API8 is — the right code, the wrong settings. Configuration failures that no amount of correct application logic can fix.
✓Six misconfiguration surfaces: CORS, verbose errors, security headers, HTTP methods, TLS configuration, and debug/admin endpoints
✓CORS deep dive — reflecting the Origin header with credentials allowed lets any website make authenticated requests as your users
✓Real incidents — Tesla 2018 (Kubernetes dashboard, no auth, cryptomining, AWS credentials) and Firebase 2018 (2,446 apps, 100M records, open default rules)
✓OWASP scenarios — CORS credential theft, verbose SQL error enabling injection, unnecessary DELETE method taking down all user records
✓Seven mitigations: CORS allowlist, sanitized errors, security headers, method restrictions, HTTPS/TLS, admin endpoint protection, and automated CI/CD scanning