OWASP API9 2023 Inventory Environment (Edit)

Make it clear which servers are expected to run in which environment to avoid unexpected problems, exposing test data to the public, or letting bad actors bypass security measures to reach production-like environments.

OWASPSecurityServersInventoryOpenAPI

Rule Definition

owasp-api9-2023-inventory-environment-error.yaml
{"owasp-api9-2023-inventory-environment-error":{"description":"Make it clear which servers are expected to run in which environment to avoid unexpected problems, exposing test data to the public, or letting bad actors bypass security measures to reach production-like environments.","message":"Declare intended environment in server descriptions using terms like local, staging, or production.","given":"$.servers.*.description","severity":"error","then":{"function":"pattern","functionOptions":{"match":"(?i)(local|sandbox|staging|production|development|test)"}}}}

Back to All of the Rules