What problem does it solve? Web applications often expose endpoints where users can access other users' data by manipulating ID parameters (IDOR), call admin APIs without proper role checks (BFLA), or reach protected pages by typing URLs directly (forced browsing). Manual review of every controller and interceptor for these access control flaws is slow and error-prone, especially across mixed Spring Boot and legacy JSP codebases. ## Core Features & Use Cases - Hybrid static detection: Runs Semgrep rules (with a grep fallback) to broadly flag candidates such as @PathVariable IDs without ownership checks, admin controllers missing @PreAuthorize, anyRequest().permitAll() gaps, and AuthInterceptor mode=off/audit. - AI context verification ladder: Each candidate is judged secure, vulnerable, or needs-runtime by tracing ownership enforcement from controller through service to the domain layer, reducing false positives from rich-domain patterns like validateOwner(). - Stack auto-detection: Distinguishes spring-modern (JWT, WebSecurityConfig) from jsp-legacy (eGovFrame session, AuthInterceptor) and applies stack-specific rules and verification points. - Use Case: Point the scanner at a Spring Boot project and receive a severity-ranked report where each confirmed BFLA or IDOR finding includes the vulnerable code location, why it is exploitable, a conceptual proof of concept, and a concrete fix such as adding @PreAuthorize. ## Quick Start Run the access control scan on my project source directory and produce a report of confirmed IDOR and BFLA vulnerabilities with file and line evidence.
