Improper asset management means organizations lose track of exposed API versions, undocumented routes, sandbox environments, and deprecated endpoints. Attackers target forgotten APIs with weaker controls or stale dependencies. The risk expands during rapid releases when governance cannot keep pace with service sprawl and shadow deployments.
Maintain authoritative inventory for all API assets, versions, and environments. Require API registration before deployment and enforce documented ownership and lifecycle status. Retire obsolete versions on schedule, monitor for unknown endpoints, and block internet exposure of unmanaged or unsupported interfaces.
The same feature written the risky way, then with the fix applied.
How this risk has ranked in each OWASP release.
2019Latest
#09api09-2019 Improper Assets Management
