hydra-gate-unsafe-auth-resolver

To detect silent authentication bypass vulnerabilities in PHP, scan service and controller methods using static analysis to find code where caught Throwable exceptions result in a null return value, bypassing role checks.

Catching exceptions and returning null creates a fail-open authorization bypass because the null value skips role validation, allowing unauthenticated users to access protected resources without triggering an error.

Prevent fail-open security issues in Nextcloud app controllers by enforcing fail-closed logic during static analysis, ensuring authorization services throw exceptions instead of returning null when failures occur.

You can use static analysis to scan for unsafe authorization resolvers in your CI pipeline by analyzing method bodies to identify Throwable suppression combined with null returns, providing clear remediation paths for code reviews.

A fail-closed authorization pattern in PHP service methods ensures that when an authorization service encounters an error or missing dependency, access is explicitly denied rather than returning null and silently allowing unauthenticated access.

No specific dependencies are required to run static analysis for auth bypass detection; the skill directly analyzes PHP service and controller method bodies to identify the combination of Throwable suppression and null return values.