Broken Access Control (A01:2021)

Analyze source code for broken access control vulnerabilities including missing authorization checks, insecure direct object references, CORS misconfiguration, JWT manipulation, directory traversal, and privilege escalation.

Supported Flags

Read ../../shared/schemas/flags.md for the full flag specification. This skill supports all cross-cutting flags. Key flags for this skill:

• --scope determines which files to analyze (default: changed)
• --depth standard reads code and checks middleware chains
• --depth deep traces authorization across call graphs and middleware stacks
• --severity filters output (access control issues are often high or critical)

Framework Context