Issue Details
Improper Inventory Management
api09-2023 • Rank #9 in OWASP 2023
Explanation
Improper inventory management persists when API versions, environments, and dependencies are not continuously tracked and governed. Attackers discover forgotten routes and stale services with weaker controls or known vulnerabilities. Lack of ownership and lifecycle management makes remediation slow and inconsistent.
Remedy
Maintain a continuously updated API inventory with explicit ownership, version status, and exposure scope. Enforce onboarding and decommission workflows for every API release. Detect shadow APIs through network and gateway telemetry, and retire unsupported surfaces quickly.
| Year | Rank | Category |
|---|---|---|
| 2023 | #9 | api09-2023 - Improper Inventory Management |