Credentials and integrations
Treat third-party API data as untrusted
Validate upstream responses, constrain redirects and destinations, set timeouts and size limits, and avoid inheriting a provider’s compromise.
8 minute lesson
A trusted provider can fail, change, or become compromised. Its response still crosses a trust boundary.
Validate response status, content type, schema, size, and meaning. Set short timeouts and bounded retries. Do not pass upstream text into SQL, HTML, shell commands, or AI tools without the same controls as user input.
A tax provider may return HTML during an outage or redirect to a private address after compromise. TLS authenticates the connection, not the schema or business meaning of its response.
Bound retries as well as individual requests. Five automatic retries can multiply an outage into resource exhaustion, while a controlled fallback keeps the failure visible to operators.
Stub normal, oversized, slow, redirected, malformed, and hostile provider responses. Record the timeout and size evidence, then prove no bad response reaches storage, HTML, SQL, or shell execution.
Lesson completed