SecAppDev Academy

SecAppDev original

OpenAPI as a security tool, not just documentation

Video and handoutsSecAppDev 2025

API security

Abstract

OpenAPI specifications are more than just documentation—they can be a powerful foundation for improving your application’s security.

This talk explores how to effectively use OpenAPI in both code-first and spec-first workflows. We’ll discuss how well-crafted specs help uncover security issues, guide audits, and power security tools for testing, automated attacks, and even runtime protection. You’ll walk away with practical insights into turning your API specs into a security asset, not just a developer convenience.

Handouts available for this lecture

Download

Chapters

  1. Introduction to OpenAPI and Swagger
  2. OpenAPI as developer documentation
  3. How OpenAPI contracts describe an API
  4. Demo: augmenting generated OpenAPI specs
  5. Using specs for security testing
  6. Demo: running an API fuzzer
  7. Auditing OpenAPI specs for security
  8. Defining error codes and authentication
  9. OpenAPI and API security vulnerabilities
  10. Demo: finding excessive data exposure
  11. Mass assignment explained
  12. Moving from code-first to API-first
  13. Preventing drift with conformance scanning
  14. Runtime enforcement with API contracts
  15. Final recommendations and takeaways

In-person course

Philippe De Ryck taught at previous editions of SecAppDev

SecAppDev is an immersive course in secure application development, running annually since 2005. World-renowned faculty from industry and academia deliver in-depth 90-minute lectures and full-day workshops in an intimate setting, typically in early June.

More about SecAppDev

Regular updates, at most twice a month

We will email you about new talks on the SecAppDev Academy, along with updates on the annual in-person course. No tracking, and you can unsubscribe at any time.