Securing Scanning APIs: The skill-scanner Hardening Journey

When an API directly accesses the filesystem and processes uploaded files, security must be architectural, not aspirational. This case study shows how skill-scanner hardened its REST API against filesystem traversal, malicious archives, and resource exhaustion through systematic boundary controls and resource limits. The practical approach—grounded in code, tests, and documentation—applies to any tool that bridges user requests and local filesystem operations.