authz-check

Name: authz-check
Author: Archive228

712stars129forks

How to install authz-check?

archive228/loopkit/authz-check

$npx -y skills add Archive228/loopkit --skill authz-check

Installs into the current project.

Summary

Verify that an endpoint checks ownership, not just authentication. Use on any handler that reads or mutates user data.

Files · 1

SKILL.md

1	# Authz Check
2	The most common security hole: the code checks you're logged IN, but not that you OWN the thing.
3	- For every resource access: does it verify the current user is allowed THIS specific record? `WHERE id = ? AND owner_id = current_user` — not just `WHERE id = ?`.
4	- IDOR test: swap the ID in the request to another user's. Does it leak/allow?
5	- Admin/privileged actions: is the role checked server-side, every time, not just hidden in the UI?
6	- Default deny: new endpoints should require explicit authorization, not be open by oversight.
7	Output each handler that authenticates but doesn't authorize, with the missing check.

6 picks

Type