Important API risks include broken object-level authorization, broken authentication, unrestricted resource consumption, broken function-level authorization, unrestricted access to sensitive business flows, server-side request forgery, security misconfiguration, improper inventory management, unsafe consumption of APIs, and excessive exposure of sensitive fields.

Security testing should verify both positive and negative authorization cases. Testing only successful requests is insufficient.

Security must be enforced on the server. Client-side hiding of buttons is not authorization.