coding

For beginners. What is actually a security issue and what just looks like one.

Finding an API endpoint doesn't mean you hacked anything

Open any modern website, hit F12, click the Network tab, and reload. You'll see dozens of requests to URLs like /api/users/me or /graphql. These are the public entry points the app itself uses. Seeing them is normal and intended.

An endpoint is like a door on a building. Finding a door doesn't mean you can walk in. The door has a lock. The lock is called authentication.

Common misconception

"I found their secret API by opening the network tab, I could hack them."

Reality

The API isn't secret. It's how the app you're using talks to the server. Whether you can do anything harmful with it depends entirely on how it's secured.

API endpoints aren't vulnerabilities by themselves

An endpoint existing is not a vulnerability. What makes one vulnerable is a specific bug:

See OWASP API Security Top 10 for the full list.

Authentication and authorization matter

Two different things, often confused.

An endpoint call typically looks like this:

GET /api/users/me
Authorization: Bearer eyJhbGciOiJIUzI1NiIs...

Without the token, the server responds 401. With a valid token for user 42, asking for /api/users/99/private should respond 403 (that's authorization working).

A Unity network endpoint isn't automatically exploitable

Many games built in Unity use networked services: matchmaking, leaderboards, inventory, purchases. Finding one of these endpoints by proxying game traffic or reading the assembly does not mean the game is exploitable.

The game's backend still has:

The client is not the source of truth. Sending a modified request usually just gets your request rejected or your account flagged.

Looking at JavaScript source isn't hacking

JavaScript that runs in your browser was downloaded to your computer. Reading it is not intrusion, it's just reading a file your own browser fetched.

Minified or obfuscated JS is still just JS. You can un-minify it with any pretty printer. Companies do this to reduce bundle size, not to keep secrets, because it doesn't keep secrets.

Reality

Real secrets (database passwords, admin keys, encryption keys) live on the server, which you cannot read. If you can read a secret in the JS bundle, the mistake was shipping it there in the first place.

Open source isn't leaked code

Open source software is intentionally published. If a company uses React, Postgres, or the Linux kernel, that code being public says nothing about the company's own proprietary code.

Licenses like MIT, Apache 2.0, and GPL exist specifically so this code can be shared and used. That is the point.

Reverse engineering isn't automatically illegal or malicious

Reverse engineering is a spectrum.

Responsible disclosure means finding a bug and telling the vendor privately so they can fix it. Exploitation means using it to harm people. These are very different activities.

Developer tools are normal tools

Chrome DevTools, Firefox Developer Tools, Postman, cURL, Wireshark, mitmproxy, Fiddler. These are standard tools every working developer uses. Opening one doesn't make you a hacker any more than opening a wrench makes you a car thief.

HTTP errors explained

Common status codes:

Seeing a 403 or 404 doesn't mean you "found" something. It usually means exactly what it says. See the MDN status code reference.

Rate limiting exists

APIs cap how many requests a client can make in a window. This prevents brute forcing, denial of service, and scraping. Hitting a rate limit is not bypassing anything, it's the system doing exactly what it's supposed to do.

HTTP/1.1 429 Too Many Requests
Retry-After: 60
X-RateLimit-Limit: 100
X-RateLimit-Remaining: 0

API keys should stay private

An API key is basically a password. If it leaks, whoever finds it can use it as you, run up your bill, or exfiltrate data.

Safe places for API keys:

Unsafe places:

Check Have I Been Pwned and tools like TruffleHog if you're worried a key already leaked.

Reading documentation is one of the best skills a developer can have

Most beginner questions are answered directly in the official docs. The error message you're looking at usually says exactly what's wrong. Reading docs is not glamorous, but it's what separates someone who solves their own problems from someone who waits for help.

Places to look before asking:

Not every exposed endpoint is exploitable

You can see an endpoint. You can send it a request. Neither of those things means you can make it do something it wasn't designed to do. Endpoints typically have:

Demonstrating that an endpoint exists is not demonstrating a security issue. If you actually find a real vulnerability, use responsible disclosure. Don't post it as a Discord flex.