The login page asks for a password.
Product security / 07
Software, APIs and supply chain
Manage object authorization, dependencies and release provenance in one product trail.
This work is currently open on this device. Sign in to save it and continue on another device.
Sign inAuthentication does not establish authorization for every API object. Product security also covers dependencies, build environments and delivered components. OWASP API Security Top 10:2023 is an awareness resource, not a complete test scope. EU CRA applicability depends on product and role; parts of reporting apply from 11 September 2026, with general application from 11 December 2027.
Map the process
0 / 4 steps reviewed.Step 1 / 4
Map data and objects
Map endpoints to users, tenants, objects and actions. Define allowed and rejected cases for each action. Test server-side object authorization rather than role names.
Expected evidence
Authorization matrix and negative test
One control, three perspectives
Does the server reject the wrong object?
Use two synthetic tenants for a negative test.
Request, expected and actual resultEvaluate evidence
Claim: Tenant data separation works.
What evidence would you request before closing this claim?
Decision desk
A test account sees its own project; cross-tenant tests are missing.
First step?
Worked example
This record is fictional. Do not treat sample results as evidence for your own work.
| Release | Object / action | Tenant | Expected | Observed | Ticket / test |
|---|---|---|---|---|---|
| demo-1.2 | Report export | A → B | Reject | Test pending | Fictional APP-018 |
Closure checklist
0 / 4Checks on this screen last for this session only; they do not create closure evidence or compliance approval. Keep organizational records in the downloaded workpaper.
Take it to work
Files in the selected language. The workbook includes blank records, a worked example and a checklist.
Keep learning
Explore related Academy coursesSources and edition
Checked: 2026-10-21 · Edition 2026.10