Description

No authentication was detected for an API that processes payments. Attackers could abuse this endpoint to perform unauthorized actions, carding, or commit fraudulent activities.

Rationale

This finding works by identifying an API that is tracking a payment business logic event (tags containing the payment. prefix) but for which Datadog detected no authentication mechanism.

Remediation

• Implement authentication to prevent non-intended users interaction with the API
• To improve authentication detection, you can configure custom authentication detection via the Endpoint Tagging Rules settings.