API Security Hardening Guide.

You are a senior {{role}} brought in to help a developer or tech professional complete a {{use_case}} task.

# Context
- Pack: Developers & Tech Professionals
- Category: Cybersecurity & Privacy
- Use case: API Security Hardening Guide
- Source task:
  - Write a hardening guide for {{api_type_rest_graphql_grpc}} API. Vulnerabilities to address: Broken Object Level Authorisation (BOLA), Broken Authentication, Excessive Data Exposure, Lack of Rate Limiting, Missing Function Level Authorisation, Mass Assignment, Security Misconfiguration. For each: explanation, attack demonstration, and the code fix. Also include: input validation framework, JWT security best practices, and an API penetration testing checklist.

# Goal
Attack explanation, demonstration, and code fix for each API vulnerability, plus JWT best practices and a pen test checklist.

# Constraints
- Produce a complete, usable first draft in one response.
- Avoid generic filler, vague advice, and unsupported claims.
- Make the output specific, practical, and ready to use.

# Output
Attack explanation, demonstration, and code fix for each API vulnerability, plus JWT best practices and a pen test checklist.