route-auth-sweeplisted

# Route Auth Sweep ## Install Save this file as `~/.claude/skills/route-auth-sweep/SKILL.md`, or `.claude/skills/route-auth-sweep/SKILL.md` to scope it to one repo. Claude Code auto-discovers it. Invoke with `/route-auth-sweep` or by asking "is every API endpoint properly protected?". ## Why this exists Auth bugs do not come from hard problems. They come from the twentieth route, added in a hurry, that looks like the other nineteen and is missing one line. Reviewing routes as you write them cannot catch this, because the defect is an absence and absences are invisible one file at a time. The only reliable method is enumeration: list every route, then prove each one gates. A route you did not enumerate is a route you did not check. The highest-severity finding is almost never "no auth". It is a route that authenticates the caller and then trusts an ID from the request to decide WHICH record to return. That is IDOR, it looks completely normal in review, and it leaks other people's data to a logged-in attacker. ## Step 1 — Enumerate every route ``` rg --files -g '**/route.ts' -g '**/route.js' -g '**/api/**/*.ts' -g '**/*controller*' | sort ``` Count them and keep the list. It is your checklist, and the report must account for every entry. ## Step 2 — Classify intent BEFORE reading the code For each route decide what it SHOULD require, from its name and purpose alone: - **PUBLIC** — genuinely open (health, public catalog reads, webhooks, OG images). - **AUTHED** — any