Solve Intelligence — API Security Assessment

Thesis

Not a product — a black-box security assessment of api.solveintelligence.com's authentication endpoints, mapped to the OWASP API Security Top 10 (2023). Likely a take-home deliverable for an interview or consulting engagement (repo name solve-intelligence-test).

Status

shipped (as a deliverable). Created 2025-07-20; single-push writeup.

Scope assessed

POST /auth/signup
POST /auth/signin

Findings (claimed Critical)

API4:2023 — Unrestricted Resource Consumption: no effective rate limiting. 200+ rapid signup requests returned 200 OK; 50+ failed logins produced no 429 or lockout. Opens DoS, brute force, credential stuffing.
API2:2023 — Broken Authentication: user enumeration via the distinct "No valid subscription..." error on signup — confirms registered emails. Demonstrated by identifying chris@solveintelligence.com.
API8/10:2023 — Input Validation / Injection: all invalid inputs (oversized payloads, malformed JSON, SQL injection probes) returned 200 OK with a generic FIELD_ERROR. No schema validation, no proper 4xx responses.

Recommendations

Rate limits: 5–10/min/IP on signup; 3–5 failed/min/IP and per-account on signin, with 429 + Retry-After headers.
Uniform generic error messages ("Invalid credentials") across auth failures.
Strict server-side schema validation with proper 4xx codes on malformed input.

Ethical framing

Black-box only, publicly accessible endpoints, no internal or privileged access, no harm caused. Standard responsible-disclosure posture.

Classification note

This is a deliverable, not a shipped product. Keeping it in the project corpus because it demonstrates security-assessment capability and is Zaid's public work. Status shipped for "delivered," tagged deliverable to distinguish from products.

Open questions

Was this for a role at Solve Intelligence, or another engagement?
Were the findings disclosed to Solve Intelligence? Acknowledged / fixed?