API Security Risk Analysis

Future Interns Cybersecurity Task 3 - 2026

Analyst

Pooja

API Tested

ReqRes Demo API (https://reqres.in)

Tools Used

• Postman (Web Version)
• Browser DevTools

Scope

Read-only testing of public demo API endpoints only. No exploitation or private APIs were accessed.

Methodology

1. Reviewed API documentation
2. Tested endpoints using Postman
3. Inspected authentication and response headers
4. Identified and classified security risks
5. Documented remediation steps

Risks Found

• RISK-001: Unauthenticated Access to Users - HIGH
• RISK-002: User PII Exposed Without Login - HIGH
• RISK-003: Missing Security Headers - MEDIUM
• RISK-004: Inconsistent Auth Model - MEDIUM
• RISK-005: Excessive Data Exposure - LOW
• RISK-006: No Rate Limiting - MEDIUM

Files

• API Security TASK_03.docx — Full security report
• Screenshots — Postman test evidence