What problem does it solve? Authentication and authorization bugs — especially IDOR and missing ownership checks — are the most common real-world breach causes, yet they slip through generic code review. This Skill provides a structured audit playbook that separates authz from authn and demands proof-of-exploit for every finding. ## Core Features & Use Cases - Authorization-first audit: Systematically hunts IDOR by checking whether every query filters by the authenticated principal, including list endpoints, mutations, and multi-tenant scoping. - Authentication checklist coverage: Reviews password hashing, JWT signature verification, refresh token rotation, session fixation, reset flows, and OAuth state handling. - Active verification commands: Supplies curl-based tests with two accounts to prove IDOR, missing auth, and mass-assignment privilege escalation. - Use Case: Before shipping a SaaS API, run the review to confirm user A cannot read user B's orders, tokens expire correctly, and password reset tokens are single-use. ## Quick Start Ask the AI to run an auth review on your API endpoints, checking for IDOR, JWT verification, and session handling issues.
