API Security Checklist for Indian Fintech

# BAD: OTP returned in response
POST /api/auth/send-otp
Response: {"status": "sent", "otp": "482910"}  # NEVER DO THIS

# GOOD: Only status returned
POST /api/auth/send-otp
Response: {"status": "sent", "expiresIn": 300}

// BAD: No authorization check
app.get('/api/transactions/:id', async (req, res) => {
  const transaction = await db.findTransaction(req.params.id);
  res.json(transaction); // Any user can see any transaction!
});

// GOOD: Authorization check
app.get('/api/transactions/:id', async (req, res) => {
  const transaction = await db.findTransaction(req.params.id);
  if (transaction.userId !== req.user.id) {
    return res.status(403).json({ error: 'Forbidden' });
  }
  res.json(transaction);
});

// Input validation example with Zod (recommended for Indian fintech)
import { z } from 'zod';

const transferSchema = z.object({
  amount: z.number()
    .positive('Amount must be positive')
    .max(500000, 'Single transaction limit exceeded')  // RBI UPI limit
    .multipleOf(0.01, 'Invalid decimal places'),
  upiId: z.string()
    .regex(/^[a-zA-Z0-9._-]+@[a-zA-Z0-9]+$/, 'Invalid UPI ID format'),
  note: z.string()
    .max(50, 'Note too long')
    .regex(/^[a-zA-Z0-9\s]+$/, 'Special characters not allowed'),
  pin: z.string()
    .length(6, 'PIN must be 6 digits')
    .regex(/^\d{6}$/, 'PIN must be numeric'),
});

# Recommended rate limits for fintech APIs:

# Authentication endpoints
/api/auth/send-otp     → 5 requests per 10 minutes per phone
/api/auth/verify-otp   → 5 attempts per OTP per phone
/api/auth/login         → 10 requests per minute per IP

# Transaction endpoints
/api/transfer           → 30 per hour per user
/api/beneficiary/add    → 5 per day per user

# Query endpoints
/api/balance            → 60 per minute per user
/api/transactions       → 30 per minute per user

// Data masking utility for Indian fintech
const mask = {
  aadhaar: (num: string) => 'XXXX-XXXX-' + num.slice(-4),
  pan: (pan: string) => pan.slice(0, 2) + 'XXXXXX' + pan.slice(-2),
  phone: (phone: string) => 'XXXXX' + phone.slice(-5),
  email: (email: string) => {
    const [user, domain] = email.split('@');
    return user[0] + '***@' + domain;
  },
  account: (acc: string) => 'XXXXXXXXXX' + acc.slice(-4),
  upi: (upi: string) => upi.split('@')[0].slice(0, 2) + '***@' + upi.split('@')[1],
};

// Usage in API response
res.json({
  name: user.name,
  aadhaar: mask.aadhaar(user.aadhaar), // XXXX-XXXX-4589
  pan: mask.pan(user.pan),              // AB XXXXXX9Z
  phone: mask.phone(user.phone),        // XXXXX67890
});