Test Your API Against Untrusted Inputs Before Attackers Do

The article explains how to test APIs for security by sending malicious inputs like large numbers, wrong types, and injection strings, ensuring endpoints return 4xx errors and never 5xx. It recommends schema validation with additionalProperties: false and length limits, and running these tests in CI on every change. The author warns that AI agents can now scale the risk of data uploads turning into code execution.