audit-authz

What problem does it solve?

Prevents production security bugs by auditing server-side authorization and ownership checks, especially where authenticated identity is present but resource access control is missing or incorrectly scoped.

Core Features & Use Cases

• Entry-point enumeration across common server handler types (server functions, HTTP routes, tRPC, GraphQL resolvers, webhooks, workers, IPC).
• Authorization classification that distinguishes public, authenticated, user-scoped, role-gated, and internal/service endpoints.
• Targeted findings for anonymous access, IDOR (ownership missing after identity), role-but-not-scoped mistakes, client-supplied admin flags, weak/absent webhook signature verification, and checks that occur after side effects.
• Actionable fixes that propose concrete code changes using the project’s existing auth helpers and require confirmation before anything is applied.

Quick Start

Run the audit-authz skill to scan your server code for missing authorization checks and produce a prioritized list of critical, high, and medium authz findings with recommended fixes.