Unmasking API Vulnerabilities: How BeVigil Strengthens Digital Security

BeVigil discovered misconfigured API access controls in a web application that allowed unauthenticated retrieval of API documentation and direct access to sensitive endpoints (token generation, PAN validation, OTP management, customer profiles, and bill payments), exposing PII and banking functionality. The report details the findings and provides remediation steps including disabling public documentation, enforcing token-based authentication, input validation, rate-limiting, removing unused routes, periodic audits, and secure coding guidance.