What problem does it solve? Most real-world breaches come from boring authorization bugs like IDOR and missing permission checks rather than exotic crypto failures, and these flaws are easy to miss in code review. This Skill provides a structured audit playbook that separates authentication from authorization and actively tests both layers. ## Core Features & Use Cases - Authorization-first audit: Hunts IDOR by checking whether every query filters by the authenticated principal, including list endpoints, mutations, and multi-tenant scoping. - Authentication review: Covers password hashing, JWT signature verification, refresh token rotation, session fixation, reset flows, and OAuth account linking. - Active verification: Uses two test accounts and curl commands to prove findings with real requests rather than speculation. - Use Case: Before shipping a SaaS API, run this audit to confirm user A cannot read user B's orders, tokens expire correctly, and mass-assignment cannot promote a user to admin. ## Quick Start Review the authentication and authorization logic in this codebase and report any IDOR, token, or session vulnerabilities with proof-of-concept requests.
