# Authz Check

> Verify that an endpoint checks ownership, not just authentication. Use on any handler that reads or mutates user data.

- Skill: `archive228/authz-check` (Agent Skill)
- Install (CLI): `npx skillmds@latest add archive228/authz-check`
- Raw SKILL.md: https://api.skillmd.com/api/skills/archive228/authz-check/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Coding & Dev Tools
- Author: archive228 (https://skillmd.com/u/archive228)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/archive228/authz-check

---

# Authz Check
The most common security hole: the code checks you're logged IN, but not that you OWN the thing.
- For every resource access: does it verify the current user is allowed THIS specific record? `WHERE id = ? AND owner_id = current_user` — not just `WHERE id = ?`.
- IDOR test: swap the ID in the request to another user's. Does it leak/allow?
- Admin/privileged actions: is the role checked server-side, every time, not just hidden in the UI?
- Default deny: new endpoints should require explicit authorization, not be open by oversight.
Output each handler that authenticates but doesn't authorize, with the missing check.