Auth Review

Perform a static, read-only security review of authentication and authorization in the current codebase. Framework- and vendor-agnostic. Output: a triage report in ./auth-review/ with findings ready to file as issues or PRs.

When to Use

• User invokes /auth-review.
• Requests like "audit auth", "find authz bugs", "review access control", "check for IDOR", "identity security review".
• Pre-release hardening or post-incident forensic code review focused on identity.

Workflow

Run these phases in order. Do not skip ahead.

Phase 1 — Enumerate every entrypoint

Identify every code path reachable by an external or semi-trusted caller. See references/enumeration.md for exhaustive patterns. A single repo often mixes HTTP, GraphQL, WebSocket, queue consumers, serverless handlers, and admin CLIs — list them all.

Deliverable: an Endpoint Inventory table: method, path / trigger, handler (file:line), auth required? (y/n/unknown), roles or scopes, notes.