broken-access-control

From README

Broken Access Control Security Check (A01:2025) What this checks Protects against unauthorized resource access caused by missing ownership checks or role enforcement. Exploitation leads to horizontal/vertical privilege escalation. For SSRF (server-side request forgery), see the dedicated ssrf skill. Vulnerable patterns Resource lookup by caller-supplied identifier with no ownership predicate before the row is returned, mutated, or acted on Privileged or admin route mounted with no role check at the route/controller declaration Ownership check that runs after the resource has already been fetched and consumed by downstream logic Ownership failure that responds with a distinct "forbidden" status, leaking that the resource exists Fix immediately Flag the vulnerable code and explain the risk. Then suggest a fix that establishes these properties: Every resource lookup by caller-supplied identifier is gated before the resource is returned, mutated, or acted on.