Unprotected Route Scan

Not a rare slip

An audit of one AI-assisted codebase found NINETEEN route handlers with no authorisation check of any kind, in an app that had been in daily use for months — because every one of them worked perfectly for the logged-in developer who asked for it.

| verdict | meaning | |---|---| | `unprotected_mutation` | a state-changing handler with no authorisation — the one to fix | | `webhook_unverified` | a webhook with neither a session check nor a signature verification | | `unprotected_read` | a read with no authorisation — often deliberate; decide rather than assume | | `protected` | an authorisation call exists (see below for exactly what that claims) | | `declared_public` | you have said this path is public on purpose |

An unauthenticated GET on a public listing is a design choice. An unauthenticated DELETE is a hole. Treating them alike gives a list too long to act on and buries the four lines that matter, so only the first two fail a deploy.

Webhooks are the trap inside the trap

A payment webhook has NO SESSION BY DEFINITION — the caller is Stripe, not a person. Demanding a session check there is noise, and worse, it teaches somebody to add a blanket exception; the blanket is what eventually covers a real route. But a webhook is not therefore unprotected: it authenticates by SIGNATURE. So an unsigned webhook is its own finding with its own fix, and a signed one is correct rather than merely excused.

What it claims, exactly

That an authorisation call EXISTS. Not that it is correct, not that it covers every branch, not that it checks the right thing — none of which a static reader can know. The output says so in as many words, because a tool implying otherwise would be sold on a promise it cannot keep.

Identifiers are matched WHOLE. An earlier version matched substrings and reported a route as protected because it called `scan(...)` — "can" was in the auth list. A false clean bill of health is the worst direction this tool can be wrong in, so short tokens are gone and "authorize" no longer matches "notauthorized".

Two escape hatches, because without them it is noise

Every codebase has one guard helper of its own and a handful of deliberately public paths. `authFunctions` and `publicPaths` exist so a team can say so — a tool that cannot be told gets ignored rather than fixed.

Verified

19 tests, 10 deliberate defects, all 10 caught — including mutations downgraded to reads, any path containing "webhook" auto-passing, the pages router silently skipped, and substring matching restored.

Delivery

Source delivered as a private repository invite within 24 hours of purchase. Single-product commercial license: use and modify in any number of products; no redistribution or resale of the source.

Interface

What you call, and what comes back. Types and signatures only — the implementation ships with the source.

  export function isRouteFile(path: string): boolean;
  export function looksLikeWebhook(path: string): boolean;
  export function handlersIn(file: SourceFile): Method[];
  export function scanRoutes(files: SourceFile[], options: ScanOptions = {}): RouteFinding[];
  export function hasUnprotectedMutation(findings: RouteFinding[]): boolean;
  export function formatRouteFindings(findings: RouteFinding[]): string;

  export type Method = "GET" | "HEAD" | "OPTIONS" | "POST" | "PUT" | "PATCH" | "DELETE" | "unknown";