Skip to main content

Stack Scan Audits Catalog Pricing Docs Scrab

Bundles/saas-authentication

Authentication Audit

saas-authentication · v1.1.1 · paid

Production-ready authentication assessment covering session management, login flow security, password handling, and OAuth integrations.

Session Management

session-management · weight 0.3

Session tokens use secure, HttpOnly, SameSite cookies
ab-002216
high
Session expiry is configured with a reasonable timeout
ab-002209
high
Refresh token rotation is implemented
ab-002206
high
Session is invalidated on password change
ab-002205
medium
Session fixation protection is in place
ab-002207
high
Auth tokens are not passed in URL parameters
ab-002210
high
Auth state is not stored in localStorage
ab-002208
medium
Remember-me uses a separate long-lived token
ab-002229
medium

Auth Flow Security

auth-flow · weight 0.3

Login endpoint has rate limiting
ab-002232
critical
Account lockout is implemented after failed attempts
ab-002230
high
Login form has CSRF protection
ab-002234
critical
Auth middleware protects all private routes
ab-002231
critical
Logout invalidates the server-side session
ab-002233
high
Auth error messages do not reveal whether email exists
ab-002225
medium

Password & Credential Policies

password-credential · weight 0.2

Passwords are hashed with a modern algorithm
ab-002222
critical
Plaintext passwords are not written to logs or errors
ab-002218
critical
Password strength requirements are enforced
ab-002217
medium
Password reset tokens are time-limited and single-use
ab-002227
high
Email verification is required on signup
ab-002223
high
Account recovery does not leak user information
ab-002226
medium

Social & Third-Party Auth

social-auth · weight 0.2

OAuth state parameter is validated
ab-002228
high
Social auth callback URLs are whitelisted
ab-002221
info
JWT tokens have a reasonable expiry if used
ab-002220
high
MFA option is available for users
ab-002224
info
Authentication library is on a recent release
ab-002219
info
Login UI provides clear user feedback
ab-002243
info
No default or test accounts in non-test code
ab-002246
info
Authentication events are logged for audit purposes
ab-002247
info

The AI Slop Detector. Find out what your AI got wrong before your users do.

We catch the slop.

Product

Stack Scan
Audits
Catalog
Bundles
Taxons
Packs
Pricing

Learn

Docs
Visual Guide
Benchmarks
Demo
Blog
Scrab

Connect

About
Contact
X (Twitter)
Privacy
Your Privacy Choices
Terms

© 2026 AuditBuffet · Built for the people shipping scary-fast.

Free Stack Scan · Pro from $9/mo