mass-assignment

From README

Mass Assignment Check (API3:2023) What this checks Protects against mass assignment (also called auto-binding or object injection) where an attacker adds unexpected fields like role=admin or isverified=true to a request body and the ORM blindly persists them. Exploitation leads to privilege escalation, account takeover, and data corruption. Vulnerable patterns ORM create or update call that spreads, merges, or destructures the raw request body, deserialized payload, or query parameters into the model DTO-to-entity copy utility invoked with no field allowlist or exclude list, copying every matching field Decoded payload bound directly into a database struct or record that includes privileged columns Endpoint that lets the caller set fields like role, permissions, admin flags, verification status, balance, or tenant id from the payload Fix immediately Flag the vulnerable pattern and explain the risk.