Improper inventory management persists when API versions, environments, and dependencies are not continuously tracked and governed. Attackers discover forgotten routes and stale services with weaker controls or known vulnerabilities. Lack of ownership and lifecycle management makes remediation slow and inconsistent.
Maintain a continuously updated API inventory with explicit ownership, version status, and exposure scope. Enforce onboarding and decommission workflows for every API release. Detect shadow APIs through network and gateway telemetry, and retire unsupported surfaces quickly.
The same feature written the risky way, then with the fix applied.
How this risk has ranked in each OWASP release.
2023Latest
#09api09-2023 Improper Inventory Management
