name	authz-check
description	Verify that an endpoint checks ownership, not just authentication. Use on any handler that reads or mutates user data.
when_to_use	new/changed endpoint, "get user X's data", a mutation, an admin action

Authz Check

The most common security hole: the code checks you're logged IN, but not that you OWN the thing.

For every resource access: does it verify the current user is allowed THIS specific record? WHERE id = ? AND owner_id = current_user — not just WHERE id = ?.
IDOR test: swap the ID in the request to another user's. Does it leak/allow?
Admin/privileged actions: is the role checked server-side, every time, not just hidden in the UI?
Default deny: new endpoints should require explicit authorization, not be open by oversight. Output each handler that authenticates but doesn't authorize, with the missing check.

Más de este repositorio

mismo repositorio

adversarial-verify

YaoYinYing/REvoDesign

Review a diff against the goal spec assuming the code is BROKEN. The reviewer that lives in the maker's head always agrees with itself — this pulls review into a hostile, separate pass. Invoke after every code change before marking work done.

2026-07-122

bisect-regression

YaoYinYing/REvoDesign

Find the exact commit that introduced a bug. Use when something worked before and broke, and you don't know which change did it.

2026-07-122

changelog-from-diff

YaoYinYing/REvoDesign

Turn a set of commits or a diff into a clean, user-facing changelog entry. Use before a release or PR description.

2026-07-122

clean-commits

YaoYinYing/REvoDesign

Turn messy WIP into clean, atomic commits with messages that explain why. Use before opening a PR.

2026-07-122

context-budget

YaoYinYing/REvoDesign

Keep the agent's context lean so accuracy doesn't collapse. Use on long sessions, big files, or when the agent starts hallucinating.

2026-07-122

design-system

YaoYinYing/REvoDesign

Make frontend output look intentional, not AI-generated. Use for any UI work — components, pages, layouts.

2026-07-122

name	authz-check
description	Verify that an endpoint checks ownership, not just authentication. Use on any handler that reads or mutates user data.
when_to_use	new/changed endpoint, "get user X's data", a mutation, an admin action

Authz Check

The most common security hole: the code checks you're logged IN, but not that you OWN the thing.

For every resource access: does it verify the current user is allowed THIS specific record? WHERE id = ? AND owner_id = current_user — not just WHERE id = ?.
IDOR test: swap the ID in the request to another user's. Does it leak/allow?
Admin/privileged actions: is the role checked server-side, every time, not just hidden in the UI?
Default deny: new endpoints should require explicit authorization, not be open by oversight. Output each handler that authenticates but doesn't authorize, with the missing check.