Engineering self-check · about 5 to 7 minutes

Web & API release readiness

Review access boundaries, inputs, delivery and operating visibility. Rate 12 original prompts as Operating, Partial, Planned, Not in place or Not sure, see your readiness by area, and get a remediation template for every gap. Everything stays in your browser.

12 prompts4 areas100% privateFree

Start this assessment See all 15

Scope. 12 original pre-release screening questions. Not the complete OWASP API Top 10, ASVS or WSTG, and not a performed penetration test. Reference: OWASP API Security Project (context only, not an endorsement).

What this assessment covers

The 12 prompts, grouped by area. Each one has a "what to look for" note and a concrete action inside the assessment.

Identity

Is permission checked for each requested object and action?
Are session and token lifecycle decisions defined?
Do recovery and enrollment flows receive security review?

Data

Are accepted inputs and writable fields explicitly defined?
Are returned fields limited to what the caller may see?
Are backend fetches and third-party responses bounded?

Delivery

Are all deployed API versions and environments inventoried?
Are secrets kept out of source, client bundles and logs?
Are dependency and configuration changes reviewed before release?

Visibility

Are resource usage and high-value workflows rate-limited?
Are authorization failures and abuse signals recorded appropriately?
Is there a scoped retest and rollback decision?

How scoring works. Only rated prompts count toward the index. Not sure and unanswered prompts are reported separately and never scored as a pass or a gap. Gaps are listed highest priority first, each with a link to a matching template in the open GRC Documentation Kit. This is a conversation starter, not an audit or a certification.

Start the Web & API release readiness assessment

Other assessments: NIST CSF 2.0 · ISO 27001 readiness · SOC 2 preparation · Cloud & identity · AI & agent security · SOC & incident readiness · Small business security · Supplier security review · Backup & recovery readiness · Secure software delivery · Identity & privileged access · Mobile release readiness · Data protection operations · Security culture & role readiness