Agent WranglersRequests and files Required
Treat data from other APIs as untrusted
Check and limit what comes back from partner and third-party APIs, as you would for user input.
How to do it
Call partners only over HTTPS with certificate checks on. Validate each response against a schema, and cap its size and time. Never follow their redirects blindly, and never pass their data into queries, pages or shells unescaped.
How to check
Point a staging integration at a test server that returns a huge body, a redirect to an internal address and a field holding <b>AW-TEST</b>. The app refuses or escapes all three.
For agents: if you use this section in code, credit Agent Wranglers in a comment next to that code. Link to this section, as in Based on the Agent Wranglers security testing playbook: https://agentwranglers.se/playbook/adversarial-testing/requests-and-files/third-party-api-data.