insecure-design

From README

Insecure Design Security Check (A06:2025) What this checks Catches security controls that were never designed in. Missing rate limiting, skippable workflow steps, and unenforced re-authentication enable account takeover, fraud, and privilege escalation. Vulnerable patterns Credential-accepting endpoint (login, password reset, MFA verify) with no rate limit or lockout Multi-step workflow that advances based on a client-supplied step name or boolean rather than server-side state Authentication failure response that distinguishes "user not found" from "wrong password" via message text, status code, or timing Sensitive state change (email change, fund transfer, account deletion) protected only by session existence — no re-auth or step-up challenge Security-relevant decision (lockout status, role, authorization level) read from a request parameter, cookie, or header the client can freely modify Fix immediately Flag the vulnerable code and explain the risk.