Skip to main content

Bundles/saas-authorization

Authorization Audit

saas-authorization · v1.1.0 · paid

Authorization layer assessment covering access control, resource authorization, API permissions, and admin boundary enforcement.

Access Control Model

access-control · weight 0.3

Authorization Model Defined
ab-002245
high
Role Hierarchy Enforced
ab-002250
high
Authorization Logic Centralized
ab-002248
low
Feature Flags Server-Verified
ab-002251
low
Role Assignment Restricted
ab-002242
low

Resource Authorization

resource-auth · weight 0.35

Every API Route Checks Permissions
ab-002249
critical
Resource Ownership Verified
ab-002252
critical
No Insecure Direct Object References (IDOR)
ab-002244
critical
File Upload Permissions Scoped to User
ab-002241
high
Shared Resources Have Access Controls
ab-002235
high
Bulk Operations Verify Per-Resource Permissions
ab-002240
medium

API Authorization

api-auth · weight 0.2

API Keys Have Scoped Permissions
ab-002237
high
Webhook Endpoints Validate Sender
ab-002236
medium
Authorization Failures Return 403
ab-002239
medium
Negative Authorization Tests Present
ab-002238
low
API Rate Limits Differentiated by Role
ab-002271
low

Admin & Privilege Escalation

admin-privilege · weight 0.15

Admin Routes Protected with Role Check
ab-002270
critical
No Privilege Escalation via Parameter Tampering
ab-002267
high
Sensitive Operations Require Re-authentication
ab-002269
high
Multi-Tenant Data Isolation Enforced
ab-002272
high
Database Queries Scoped to Tenant
ab-002268
high
No Cross-Tenant Data Leakage in List Endpoints
ab-002266
high