code-audit-authz

This authorization audit scans server functions, HTTP route handlers, webhook receivers, queue workers, and IPC handlers to classify access scope and identify missing ownership checks for user-scoped resources.

Auditing webhook handlers for weak validation requires classifying their access scope and verifying enforcement against existing auth helpers to detect accidental anonymous access to user-scoped data and ordering issues that leak information.

Yes, this authorization audit explicitly supports TanStack Start server functions, HTTP route handlers, webhook handlers, queue workers, and IPC handlers where request inputs name resources like userId or orgId.

The best way to detect role-based access control mistakes is to enumerate all server entry points, classify access requirements into public, authenticated, user-scoped, and admin-gated scopes, and verify enforcement against existing auth helpers.

To fix flagged authorization bugs, you apply targeted code changes using the project's existing auth helpers, with the audit requiring explicit confirmation before applying fixes to remediate missing auth checks and IDOR patterns.

You need to audit server-side authorization for user-scoped resources when authenticated users risk accessing or modifying resources they do not own, or when endpoints accidentally allow anonymous access to user-scoped data across your codebase.