API corridor
Your endpoints answer to anyone who asks. Anyone.
Other people's stuff
Changing a number should not change whose data you see.
0/4 scenarios fixedUnlock this door
Webhooks
Anyone can POST. Verify before you believe.
0/2 scenarios fixedUnlock this door
File uploads
An upload field is a door. Check what walks in.
0/3 scenarios fixedUnlock this door
Tokens & JWTs
A token is only as honest as how you signed it.
0/3 scenarios fixedUnlock this door