API Security
Finding and fixing broken authorization, business-logic flaws, and identity weaknesses in modern APIs.
HI, I’M
MSAMBILI NDAGA
Developer Advocate, API Security Specialist, Agentic AI Security researcher, and cybersecurity professional.
Certified API Red Team Analyst (CARTA)API Security Certified Associate (ASCA)
WHAT I DO
Securing the APIs and AI systems developers depend on.
Agentic AI Security
Researching prompt injection, unsafe tool use, excessive agency, and security boundaries for AI agents.
Developer Advocacy
Making complex technical ideas useful through writing, workshops, and developer communities.
FEATURED PROJECTS
Open-source tools for secure development and practical learning.
VS Code security extension
Ch3ck3r SAST
A local-first static application security testing tool with OWASP API Top 10 rules, OpenAPI analysis, SARIF reporting, and secure CI release evidence.
View project Secure code review trainingReviewer
An open-source training platform for identifying and remediating vulnerable web, API, AI, and MCP code through realistic review challenges.
View project API testing and security labPostman API Testing Framework
Postman and Newman automation with mock environments, CI reporting, and a localhost-only service for comparing secure and vulnerable API behavior.
View project Chrome extensionAPI Finder Extension
Passive API reconnaissance with endpoint discovery, request analysis, findings export, and a built-in request tester.
View projectFOUNDER & COMMUNITY LEAD - APICON TANZANIA
Building Tanzania’s API community.
I founded APICon Tanzania to advance API Security, DevSecOps, software engineering, and practical collaboration across the regional developer ecosystem.
Read my storyTOOLBOX
Tools and standards I use to move from integration to assurance.
Tools & technologies
Postman
Burp Suite
OWASP ZAP
Swagger / OpenAPI
GitHub
Git
JavaScript
TypeScript
Python
PHP
Next.js
Docker
GitHub Actions
GitLab CI
Jenkins
API security stack
OWASP API Security Top 10REST API SecurityGraphQL SecurityOAuth 2.0OpenID ConnectJWTAPI Threat ModelingAPI Penetration TestingSecure API DesignAPI DocumentationDevSecOps
LATEST WRITING
Notes for people building modern systems.
Developer experience
From SDK to System: Choosing Developer Tools That Fit
A practical guide to selecting SDKs, APIs, frameworks, and development tools for secure, maintainable systems.
DevSecOps
DevSecOps Is Not a Checkbox
Embedding security into the software lifecycle without turning it into ceremony.
Architecture
Zero Trust API Architecture
Identity, policy, transport, and telemetry for every API request.
LET’S CONNECT