Work 2025 Security engineer Case study
NoteVault
An API security hardening case study
- 8
- Findings
- 7 (1 false positive)
- Fixed
- Critical IDOR
- Worst
A three-tier notes API taken from deliberately vulnerable to hardened: threat model, Semgrep and OWASP ZAP scans, then fixes for a critical IDOR, missing rate limits, wildcard CORS, missing security headers, user enumeration, weak passwords and CSP wildcards.
The point was not the app. The point was the loop: model the threats, scan with Semgrep and ZAP, fix, re-scan, and write down why each fix works.
Eight findings. The worst was a critical IDOR on GET /notes/user/:userId, fixed with an ownership check. Login and registration got rate limits, CORS lost its wildcard, helmet added security headers, error messages and timing stopped revealing which accounts exist, passwords got a policy, and the CSP lost its wildcards and unsafe-inline. One finding, CSRF, was shown to be a false positive: the API uses bearer tokens, not cookies. Then ZAP ran again.