API Security Checklist: Auth, Rate Limits, and Abuse Cases The missing checklist that prevents “oops, we got scraped.”