Source code
Security & compliance
Route authorization
Broken access control, across whatever framework you used.
Overview
lumioguard walks your route definitions and data-access calls in Express, Fastify, Hono, Next.js, NestJS, Django, Rails, Prisma, Drizzle, TypeORM, and Mongoose, and reports where an object id from the request is never bound to the caller who sent it.
What it looks for
- Records fetched by request id with no owner or tenant check (IDOR)
- State-changing routes with no auth guard
- Privileged operations with no role check
- Request bodies written wholesale into a model (mass assignment)
Why it matters
Broken access control is the top entry in the OWASP Top 10 because it needs no exploit. Changing an id in a URL is the whole attack, and every affected record leaves through an endpoint that returns 200 and logs nothing unusual.
Rules in this check
| What it reports | Fix path |
|---|---|
| Object fetched by request id with no owner check (IDOR) | Pull request |
| Missing auth guard on a state-changing or sensitive route | Pull request |
| Broken function-level authz: privileged operation with no role check | Pull request |
| Mass assignment: request body written wholesale into a model | Pull request |
How the fixes arrive
Pull requestLow-risk changes arrive as a pull request on a lumioguard branch, with a breakage analysis attached. You review and merge it.
Run them all on your app
Connect your repo and your live services with read-only scopes. The first scan is free, and nothing changes without your approval.