Secure API design and testing strategies