security-review

Review a GraphQL API for authorization and authentication weaknesses by validating ctx.user across resolvers, enforcing Row-Level Security, and preventing sensitive data leakage. This targets Firebase authentication and issuer-based access controls to secure multi-tenant services.

Row-Level Security prevents data leakage by enforcing issuer-based access controls at the database layer, restricting queries so tenants only access authorized rows. It complements ctx.user validation in resolvers to block unauthorized data retrieval in multi-tenant GraphQL services.

Audit GraphQL resolvers for missing context user validation by checking that every resolver enforces ctx.user before processing requests. This ensures authenticated access and identifies gaps in authentication checks across use cases, preventing unauthorized API interactions.

Yes, this security review works with Firebase authentication and parameterized database queries. It targets codebases implementing these features, auditing secure logging, secret management, and parameterized queries to prevent injection and protect sensitive user data.

Stop sensitive data exposure in GraphQL secure logging by auditing logging practices to ensure secrets and user data are redacted. The review identifies data-handling weaknesses and enforces secure logging requirements to prevent accidental leakage of sensitive information.

Yes, you can analyze a specific Git branch for GraphQL authorization issues by specifying a path or branch to review. The analysis targets the working tree to document authentication, RLS, and data-handling gaps, providing targeted remediation guidance.