Audit kepatuhan standar keamanan finansial, enkripsi data in-transit/at-rest, dan mitigasi OWASP API Security.
| Kategori OWASP | Cakupan Pengujian & Proteksi | Status |
|---|---|---|
| API1: Broken Object Level Auth (BOLA) | Pemberlakuan validasi kepemilikan merchant_id & user_id pada tiap query database level middleware. | PASSED |
| API2: Broken Authentication | OAuth 2.0 / JWT dengan masa kedaluwarsa singkat, OTP expiry 5 menit, dan proteksi brute-force rate limiter. | PASSED |
| API3: Broken Object Property Level Auth | Filtering payload request & response DTO untuk mencegah data leak dan parameter tampering. | PASSED |
| API4: Unrestricted Resource Consumption | Pemasangan Global & Per-IP Rate Limiting, connection pool capping, dan query pagination limit. | PASSED |
| API5: Broken Function Level Auth (BFLA) | Role-Based Access Control (RBAC) ketat memisahkan admin, auditor, operator, dan merchant privilege. | PASSED |
| API6: Server-Side Request Forgery (SSRF) | Webhook callback URL whitelist validation & isolasi DNS internal network. | PASSED |
| API7: Security Misconfiguration | CORS strict origin, CSP headers, HSTS, X-Content-Type-Options, penonaktifan stack trace di production. | PASSED |
| API8: Lack of Protection from Automated Threats | Bot rate-limit, validasi payload signature B2B, dan challenge mekanisme OTP registrasi. | PASSED |