APIs don’t become insecure overnight. The choices we engineers make on a daily basis, and the processes we use to govern those choices, define whether an API becomes a business enabler or a breach waiting to happen.

This talk reframes API security through the lens of software engineering leadership: how to align design and implementation with security principles, without sacrificing velocity. We’ll explore the most common design pitfalls (and how to avoid them), why developer experience and security are two sides of the same coin, and the practices that make secure API design scalable across teams.

Attendees will leave with a set of guiding principles and practical strategies for leading engineering teams to deliver secure-by-default APIs—and the confidence to know that their architecture can stand the test of scale, complexity, and attacker creativity.