Enterprise API Security Platform

Secure Payroll Management API demonstrating practical API security engineering: authentication, authorization, audit logging, encryption, rate limiting, security testing, and remediation.

Business Problem

Payroll APIs expose sensitive employee and compensation data. Weak API security can lead to unauthorized payroll access, account takeover, sensitive data exposure, and poor incident visibility.

This project shows how to design, build, test, and document a secure enterprise API rather than just run a scanner.

Features

• JWT authentication with short-lived tokens
• Role-based access control for employees, payroll administrators, and auditors
• Object-level authorization to prevent broken object level authorization attacks
• Payroll response minimization with bank account masking
• AES-256-GCM encryption for sensitive stored bank account data
• Structured audit events for authentication, access, denial, and admin actions
• Rate limiting and JSON payload limits
• Security headers via Helmet
• Automated API tests for abuse cases
• CI security pipeline with npm audit, Semgrep, Gitleaks, and Trivy

Quick Start

npm ci
npm test
npm start

The API starts on http://127.0.0.1:3000 by default.

Set JWT_SECRET for stable local tokens across restarts. If it is omitted, the app generates an in-memory startup secret.

Demo Accounts

Role	Email	Password
Employee	alice@company.example	alice-demo-password
Employee	ben@company.example	ben-demo-password
Payroll Admin	payroll.admin@company.example	admin-demo-password
Auditor	auditor@company.example	auditor-demo-password

These are intentionally fake local lab credentials.

API Examples

Login:

curl -s http://127.0.0.1:3000/auth/login \
  -H 'content-type: application/json' \
  -d '{"email":"alice@company.example","password":"alice-demo-password"}'

Read own payroll record:

curl http://127.0.0.1:3000/employees/emp-1001/payroll \
  -H "authorization: Bearer ${TOKEN}"

Run the abuse-case smoke test:

BASE_URL=http://127.0.0.1:3000 ./scripts/security-smoke-test.sh

Security Documentation

• Threat model
• OWASP API Security mapping
• Security test report
• Recruiter brief

Recruiter Summary

This project demonstrates secure API engineering and AppSec thinking across design, implementation, testing, and remediation. It is especially useful for roles involving API security, application security, DevSecOps, security engineering, and vulnerability remediation.