iam-reviewlisted

# IAM Review Review scope: **$ARGUMENTS** ## Steps ### 1. Authentication Flow - How do users authenticate? (email/password, OAuth, magic link, API key) - Is the auth library properly configured? (NextAuth, Passport, custom) - Is password hashing using bcrypt/argon2 with proper cost factor? - Is there rate limiting on auth endpoints? (login, register, password reset) - Are password reset tokens single-use and time-limited? - Is MFA available for sensitive operations? ### 2. Session Management - Where are sessions stored? (JWT, database, Redis) - Are cookies configured securely? - `httpOnly: true` (prevents XSS token theft) - `secure: true` (HTTPS only) - `sameSite: 'lax'` or `'strict'` (CSRF protection) - What's the session lifetime? (should be hours, not weeks) - Can users invalidate sessions? (logout, revoke all sessions) - Is there session fixation protection? ### 3. Authorization (RBAC) - Are roles well-defined and documented? - Is authorization checked at every protected endpoint (not just the UI)? - Are there IDOR vulnerabilities? (user A accessing user B's resource by changing ID) - Is there a consistent authorization middleware/pattern? - Are admin endpoints properly protected? - Is the principle of least privilege applied? ### 4. API Key Management - Are API keys hashed in the database (not stored in plain text)? - Can keys be rotated without downtime? - Do keys have scoped permissions (not full access)? - Are keys transmitted securely (header, not URL que