access-review

To review authorization and access control for IDOR and BOLA, this Skill performs deep security audits tracing read, write, and delete actions to verify users only access permitted data. It maps tenant boundaries to detect broken object or function level authorization.

Testing tenant isolation in a multi-tenant SaaS application requires mapping tenant and identity models from schema and auth code. This Skill provides guidelines to verify role boundaries and prevent unauthorized cross-tenant data access during security reviews.

Detecting privilege escalation and BFLA issues in APIs involves tracing authorization checks across user actions. This Skill audits role boundaries and function level authorization to identify and mitigate unauthorized privilege escalation vulnerabilities.

Yes, you can audit internal tools and marketplaces for unauthorized data access. This Skill applies security reviews to APIs, marketplaces, and internal tools, verifying that authorization policies prevent users from accessing restricted data and actions.

Tracing authorization policies across a project codebase requires a structured review workflow. This Skill includes a step-by-step process covering policy checks, identity mapping, and authorization tracing to ensure comprehensive access control verification.

A dedicated security review for access control is needed when building SaaS products, APIs, or multi-tenant systems to prevent unauthorized data access. It verifies role boundaries, tenant isolation, and authorization checks for all user actions.