# API security

* Authenticate and authorize protected endpoints; validate every request payload and identifier.
* Bound request and response sizes, pagination, query results, and expensive operations.
* Apply rate limits where abuse is plausible and keep administrative endpoints separately protected.
* Return only authorized data and never expose stack traces, internal models, or implementation details in API errors.
* Prefer explicit DTOs and schemas over deserializing arbitrary types or executable objects.