Session Abstract

Most REST anti-patterns are not just style issues. In the wrong context, they become security bugs hidden behind what looks like “best practice” code. In this hands-on session, we will take common REST API mistakes and show what they actually cost when someone hostile is on the other side of the request. The session will cover issues such as tokens in query strings, guessable IDs, missing ownership checks, stack traces in production, overly detailed error messages, weak pagination, missing rate limits, wildcard CORS, broken versioning, and services that trust each other too easily. A special focus will be on AI-agent-written code, where the same problems increasingly appear at scale: authentication without authorization, happy-path tests that pass, unsafe defaults, and “quick fixes” that make the red text disappear while creating real risk. Participants will break the vulnerable patterns first, then fix them — learning how to design APIs that do not leak data, trust the wrong things, or hide security problems behind green tests.

Note to event organizers

This can be a session or a workshop.

Wekoslav Stefanovski

Wekoslav Stefanovski has more than two decades of professional developer experience using a variety of development technologies. Has been using C# since the first public beta, and has a long and fruitful love relationship with it. Has been using JavaScript since the previous millennium and has a long and fruitful love/hate relationship with it. Currently, works at Sourcico as Head of development. He is passionate about functional programming, static code analysis, compiler design and code quality metrics.

Back to speaker profile