What problem does it solve?
Django-based applications often suffer from subtle authorization gaps (e.g., IDOR, insufficient ownership checks). This Skill provides a structured approach to identify and remediate those gaps by analyzing how permissions are enforced, how data is scoped, and how object-level access is guarded across views, serializers, and models.
Core Features & Use Cases
- Analyze authorization model: locate where permission checks are implemented (decorators, DRF permission classes, mixins, or middleware) and determine their effectiveness.
- Inspect query scoping: verify get_queryset and managers enforce user/tenant ownership to prevent cross-user access.
- Validate object-level protections: assess has_object_permission and get_object() usage to ensure proper access control for each resource.
- Produce evidence-backed findings: document gaps, potential risks, and concrete remediation steps with minimal false positives.
- Use Case: security engineers reviewing an existing Django project to ensure a user cannot access another user's data, even if they know the resource ID.
Quick Start
Begin by tracing authorization checks in a Django app, focusing on how views fetch objects and how permissions are applied.
