The API security checks worth doing before launch

Not a compliance exercise. The specific things that get exploited on small production APIs.