Object ownership
Review whether a request can read or change another user’s records by supplying a different identifier.
Galen SecurityProtect what your APIs
GALEN SECURITY / API SECURITY AUDIT
Protect what your APIs
let people reach.
Review web application APIs for broken ownership checks, tenant isolation, and sensitive actions. Galen Security maps endpoints to code paths, data access, and security controls, then checks those relationships against approved access rules where a baseline is established.
Available now: Galen Policy Beta and Managed Galen Security Audits. Self-service Galen Security is coming soon.
Inspectable evidenceRemediation and validation
WHAT THE AUDIT COVERS
A valid request still needs the right permissions.
Knowing who sent a request is only the start. The API must also enforce which record, field, or action that identity is allowed to reach.
Tenant isolation
Examine how reads, writes, exports, and shared handlers stay inside the correct customer or organization boundary.
Function and field access
Check privileged endpoints and response fields against the approved roles and permissions. Identify new grants, removed guards, or wider field exposure as the API changes.
Sensitive business actions
Review billing changes, exports, account administration, and other operations that require explicit authority.
Input and data handling
Trace request parameters through queries, mutations, serializers, and downstream operations for unsafe flows.
Agent and integration access
Include the API paths called by tools and integrations so their access is reviewed alongside the application’s other entry points.
A FINDING IN CONTEXT
An invoice ID crosses a customer boundary.
An invoice endpoint checks that the caller is signed in, then loads the invoice by ID without checking its customer or tenant.
Illustrative scenario, not a live scan or actual customer finding.
FOLLOW THE PATH
- 01Customer request
- 02Invoice lookup by ID
- 03Another customer’s invoice
What makes it risky
Authentication is enforced, but the record lookup does not enforce the caller’s ownership boundary.
What to change and recheck
Scope the lookup to the authorized customer or tenant and recheck read, update, and export paths that use the same record.
FROM FINDING TO CORRECTION
Give your team
something it can act on.
Review the evidence, make a focused correction, and check the result against the original risk.
See how Galen Security works- Findings tied to an endpoint, handler, and affected operation.
- Ownership, role, tenant, and data-flow evidence for the risk.
- Remediation direction for the missing boundary or unsafe path.
- Validation status after the corrected endpoint is reviewed.
A FEW PRACTICAL QUESTIONS
Plan the review.
Does this include APIs used by AI agents?
Yes. An agent’s tool calls can reach the same sensitive records and actions as any other API client. Include those endpoints in scope; use the AI Agent Security Audit page for the wider tool and permission context.
Do you need source code or a running environment?
The materials depend on the review. Source supports code-path and control analysis; a scoped running environment can support managed runtime checks. Telhawk confirms the required access and testing boundaries for the engagement.
Does a working login prove an API is secure?
No. A signed-in caller may still reach the wrong record, tenant, field, or administrative action. Galen relates endpoints to the underlying data operations and controls, helping reveal inconsistent protection across routes that reach the same resource.
RELATED AUDITS
Follow the risk
across your application.
MANAGED NOW / SELF-SERVICE COMING SOON
Choose who leads
the review.
Telhawk-led managed engagements are available now. Self-service Galen Security is coming soon.