Risk-based API testing
Direct API testing of server-side controls, authorization enforcement, and input validation across the documented endpoints, prioritized by attack surface: AI processing, file upload, and account management first.
Case Study / API penetration testing
Prompt injection in an AI endpoint: found and fixed
API VAPT of an AI-featured SaaS product: prompt injection, unrestricted file upload, and a null-byte bypass, all remediated and verified clean on retest.
SaaS · AI product · API VAPT
The problem and the risk
AI features route user input straight into a model, and most API test plans never go near them. A SaaS product with AI-powered features engaged us to close that gap: a two-week API vulnerability assessment and penetration test across its documented surface, run to NIST SP 800-115 and the OWASP API Security Testing methodology. Scoping happened with the testers who would do the work, and it put the AI-processing endpoints, file upload, and account workflows first as elevated-risk surface.
- High
- 3
- Medium
- 1
- Low/Info
- 1
Approach
Exploit-verified findings
Every finding was validated for exploitability by hand. The prompt-injection and upload-bypass issues were demonstrated end to end.
AI-aware assessment
The engagement treated the AI endpoints as their own attack surface (prompt isolation, instruction handling, and model-integration boundaries), an area most API tests skip entirely.
Remediation-focused reporting
Findings were grouped by affected functionality with specific server-side fixes, so the team could remediate by area rather than chase a flat list.
Technology & methods
- OWASP API Security Testing methodology
- NIST SP 800-115
- Manual exploit verification
- Prompt-isolation and instruction-handling review
- Upload allow-list and content-signature validation
- Clean-scan retest verification
Findings
Prompt injection in an AI rewrite endpoint (High)
An AI text-rewrite endpoint took a user-controlled parameter straight into the model prompt. Crafted instructions in that parameter overrode the intended function and made the model follow arbitrary instructions, the class of flaw that can leak system prompts or hidden context when an AI is wired to other tools and data. Insufficient isolation between system and user content was the root cause.
Unrestricted file upload (High)
Upload endpoints accepted files without enforcing an allow-list of extensions, MIME types, or content signatures: a path to hosting malicious content and, in some deployments, code execution.
Double-extension upload bypass via null byte (High)
Even where filtering existed, a null-byte double-extension trick slipped disallowed file types past validation. Demonstrated, not asserted.
No rate limiting on OTP verification (Medium)
OTP verification endpoints had no rate limiting, CAPTCHA, or throttling, leaving one-time codes open to brute force.
Input-validation & misconfiguration findings (Low/Info)
A tail of lower-severity issues: thin server-side input validation (HTML/JS acceptance), weak password-history control, information disclosure via server headers, and missing security headers.
Remediation, validation & outcome
- Zero critical findings; three High-severity issues clearly prioritized for immediate fix.
- The client remediated the findings and a follow-up retest in June 2026 returned a clean scan, closing the loop.
- The AI endpoints gained prompt-isolation controls, and file upload moved to strict allow-list validation with content-signature checks.
Client identity is confidential by agreement. The engagement is published anonymized; we never publish metrics we didn't measure.
What this engagement taught us
AI endpoints deserve elevated-risk scoping from day one: they are business logic wired to a model, and standard API test plans walk straight past them. The second lesson is older. Upload validation that trusts a filename remains the quickest way past a filter, and a single null byte was enough to prove it here.
Ready to scope the work?
A 30-minute call with the engineers who will do the testing, not a sales gate.