hydra-gate-orphan-auth

To find uncalled authorization methods in PHP codebases, run a static analysis scan that cross-references public method signatures against project-wide call patterns to detect security guards that are implemented but never invoked.

Orphaned authorization code consists of guard-rail methods like is, requires, validate, or authorize that are fully defined but never invoked by callers, causing OWASP A01:2021 Broken Access Control vulnerabilities when security checks are bypassed.

You can detect dead authorization code during CI/CD pipelines by integrating static analysis that scans service and controller classes for guard-rail patterns with zero external callers, automatically flagging methods like isTransitionAllowed before deployment.

Static analysis works for finding unused PHP validation logic by analyzing public method definitions in service and controller classes and cross-referencing them with project-wide call sites to ensure all implemented security guards are actively integrated.

The best way to prevent security gaps from unused PHP controller methods is scanning for orphaned authorization patterns and verifying that every implemented guard-rail method has active external callers within the application flow.

Implemented security logic fails to protect your PHP application when authorization methods exist but are never invoked by state-change callers, meaning functional-looking security checks are bypassed during actual application execution.