Cool, but hey get this... I'm interviewing next week some guys working
in API security. and the discussion notes so far are terrifying.
People do all this work to build secure networks and OS, and then
someone says "Hmm we need an API for <fashionable reason>", and next
thing a junior dev exposes all the top level functions of a program
running with high privileges as URL handlers.
So maybe even _within_ your app it's not too paranoid to think "what
if someone got an entry point into this function?" and at least put a
"NEVER EXPOSE" comment there :)
Cool, but hey get this... I'm interviewing next week some guys working in API security. and the discussion notes so far are terrifying.
People do all this work to build secure networks and OS, and then someone says "Hmm we need an API for <fashionable reason>", and next thing a junior dev exposes all the top level functions of a program running with high privileges as URL handlers.
So maybe even _within_ your app it's not too paranoid to think "what if someone got an entry point into this function?" and at least put a "NEVER EXPOSE" comment there :)