code-audit-authz

What problem does it solve?

It helps you detect authorization vulnerabilities in your backend where authenticated users can access or modify resources they do not own, or where endpoints accidentally allow anonymous access to user-scoped data.

Core Features & Use Cases

• Enumerates server entry points: scans server functions, HTTP handlers, webhook receivers, queue/worker handlers, and IPC handlers to build a complete audit surface.
• Classifies access requirements: distinguishes public, authenticated, user-scoped, admin/role-gated, and service/internal endpoints based on how inputs map to resources.
• Flags concrete authz findings: detects missing auth checks, IDOR patterns, admin gating mistakes, weak webhook validation, and ordering issues that can leak information.
• Produces actionable fixes: recommends targeted code changes using the project’s existing auth helpers, and requires confirmation for applying fixes.

Quick Start

Audit your codebase for authorization bugs by running: audit auth for every server-side entry point and return findings with severity and the exact missing check.