Results for “broken-access-control”

Reviews Django codebases for access control vulnerabilities and IDOR by tracing authorization flows, mapping attack surfaces, and reporting confirmed gaps with enforceable fixes.

Guides building secure admin panels with RBAC, audit logging, and step-up controls for privileged actions.

Detects fail-open insecure defaults (hardcoded secrets, weak auth, permissive security) that allow apps to run insecurely in production. Use when auditing security, reviewing config management, or analyzing environment variable handling.