You finished API9 — Improper Inventory Management. Here’s what you now understand:
✓Three failure types: version sprawl (old versions still live), environment exposure (staging on the internet), and undocumented endpoints (never in the docs, never in scope for security)
✓Why version sprawl happens — no inventory, no deprecation process, security patches applied only to current versions, cloud makes spinning up environments trivially easy
✓Two attack patterns: version downgrade (call v1 to bypass v2’s security) and environment pivot (find staging via cert transparency, access real data through weak auth)
✓Facebook Graph API v1 / Cambridge Analytica — the friends permission was removed in v2, but v1 kept running; 87 million profiles harvested from 270,000 installs
✓USPS undocumented API (2018) — an undocumented endpoint let any authenticated user query any other user’s data; 60M accounts exposed
✓API9 amplifies every other risk — a BOLA patch in v2 is irrelevant if v1 still runs with the original BOLA; inventory management is infrastructure for all other security work
✓Seven mitigations: complete inventory, formal deprecation with sunset dates, network restriction of old versions, same controls on all versions, environment separation, automated discovery scanning, API gateway as single entry point