argus

White-box detection of broken authorization (BOLA/IDOR, BFLA, access-control logic flaws) in an API or web codebase. Use when asked to audit authorization, hunt IDOR/BOLA, check object-level or function-level access control, or verify that handlers scope data access to the current principal/tenant. Reconstructs the app's ownership model first, then finds access paths that skip the per-object/per-role check their peers enforce. Static, read-only; delegates injection/secrets/path-traversal to run_semgrep/run_gitleaks.

Fast security pass over a pull request diff — scanners plus a targeted grep for risky patterns.

Find committed secrets and draft a prioritised, step-by-step rotation plan saved to context.

Build a STRIDE threat model of a codebase from its structure and code, using the bundled template.