Detect IDOR and authorization flaws in web applications and APIs.
npx skills add https://github.com/fatihkan/badi --skill sc-authz-fatihkan
Please help me install this Agent Skill. Skill: sc-authz Source: https://github.com/fatihkan/badi/tree/main/.claude/skills/security-check/sc-authz Command: npx skills add https://github.com/fatihkan/badi --skill sc-authz-fatihkan
Authorization flaws like IDOR and broken access control enable unauthorized data access across users and roles.
Run the scanner against a target web application to surface IDOR and access-control flaws.
High-intent search queries and answers about installing and using this skill.
To detect IDOR vulnerabilities, the scanner statically analyzes routing to data access layers, tracing endpoints and ownership checks to identify broken access control issues across web apps and APIs.
Finding broken access control flaws in APIs requires static pattern discovery across controllers, services, and middleware to verify role-based controls and data access patterns, outputting structured findings with remediation guidance.
Yes, it identifies horizontal and vertical authorization issues by statically tracing data access patterns from routes through repositories, verifying ownership checks and role-based policies across common web stacks.
IDOR detection works across languages and frameworks by applying static pattern discovery to observe routes, controllers, and policies, identifying broken access control wherever data access patterns are visible.
Tracing endpoint routes to data access layers for security testing involves statically analyzing controllers, services, and middleware to map data flows and identify missing role-based controls or ownership checks.
Remediation steps for broken access control findings include structured guidance and verification steps to close gaps, detailing how to implement missing ownership checks and role-based policies across the affected endpoints.
edulazaroGenerate API documentation from Laravel routes, controllers, and form requests.
meridianhubAutomate security scanning with gosec, Trivy, and SBOM generation in CI/CD pipelines.
jaskaranhundalOrchestrate SAST, DAST, SCA, and secrets scanning tools to correlate and prioritize findings.
AnsteorraPerform static and dynamic security audits on the KMP application.
