# broken-access-control

> Claude/Codex skill by [@thejefflarson](https://omgskills.com/library/thejefflarson/index.md) · 20 stars · Updated 2026-07-31

Detects missing ownership checks, broken role enforcement, and IDOR vulnerabilities that let users access other users' resources. Use when writing code that checks authorization, enforces resource ownership, handles IDOR (object-level authorization), processes server-side requests to external URLs, or implements access control middleware.

Tags: llms, security, skills

## Install

```sh
git clone https://github.com/thejefflarson/soundcheck /tmp/soundcheck && ln -s /tmp/soundcheck/.claude/skills/broken-access-control ~/.claude/skills/broken-access-control
```

## From README

Broken Access Control Security Check (A01:2025) What this checks Protects against unauthorized resource access caused by missing ownership checks or role enforcement. Exploitation leads to horizontal/vertical privilege escalation. For SSRF (server-side request forgery), see the dedicated ssrf skill. Vulnerable patterns Resource lookup by caller-supplied identifier with no ownership predicate before the row is returned, mutated, or acted on Privileged or admin route mounted with no role check at the route/controller declaration Ownership check that runs after the resource has already been fetched and consumed by downstream logic Ownership failure that responds with a distinct "forbidden" status, leaking that the resource exists Fix immediately Flag the vulnerable code and explain the risk. Then suggest a fix that establishes these properties: Every resource lookup by caller-supplied identifier is gated before the resource is returned, mutated, or acted on.

## Links

- HTML page: https://omgskills.com/library/thejefflarson/soundcheck/dot-claude/skills/broken-access-control/
- GitHub: https://github.com/thejefflarson/soundcheck
- Author: [@thejefflarson](https://omgskills.com/library/thejefflarson/index.md)

## More from this repo

- [authentication-failures](https://omgskills.com/library/thejefflarson/soundcheck/dot-claude/skills/authentication-failures/index.md) — Detects weak password storage, flawed JWT validation, sessions surviving logout, and missing MFA in authentication code.
   - [@thejefflarson](https://omgskills.com/library/thejefflarson/index.md) · 20 stars
- [concurrency-correctness](https://omgskills.com/library/thejefflarson/soundcheck/dot-claude/skills/concurrency-correctness/index.md) — Detects multi-threaded code where a lock is held across a blocking operation, lock acquisition order risks deadlock,...
   - [@thejefflarson](https://omgskills.com/library/thejefflarson/index.md) · 20 stars
- [contract-review](https://omgskills.com/library/thejefflarson/soundcheck/dot-claude/skills/contract-review/index.md) — Deep review that audits API contracts for mismatches between what callers assume and what implementations enforce.
   - [@thejefflarson](https://omgskills.com/library/thejefflarson/index.md) · 20 stars