Apply the same validation, sanitization, and security controls to third-party API responses as you apply to user-submitted data. No exceptions based on source reputation.

Validate type, length, and format. Parameterize SQL. Escape HTML. Strip dangerous patterns before logging. Applied at the point of use, not at the integration boundary.

Any URL fetched server-side — including URLs from third-party responses — must be validated against an allowlist. Validate the destination of redirects, not just the source. Disable redirect following where not needed.

Evaluate a third-party vendor’s security posture before integrating. Review their security practices, incident history, and data handling. Prefer vendors who publish SOC 2 Type II reports or equivalent attestations.

For CDN-hosted scripts loaded in HTML, use the integrity attribute with a cryptographic hash. The browser refuses to execute the script if the hash doesn’t match. This prevents CDN compromise from delivering modified scripts.

Scope third-party API permissions to exactly what’s needed. Don’t grant write access if only read is needed. Use separate API keys per integration. Rotate keys regularly. Revoke immediately on vendor incident.

Run third-party integrations in isolated services or sandboxed environments with minimal permissions. A compromised third-party response processed by an isolated adapter cannot affect the core API or database directly.