Scan rule · RSC-SEC-058
Server Action without an access check
SecuritySeverity: HighCWE-862OWASP A01-2021
Inspects the body of every `"use server"` function that writes to the database and reports a missing identity check — server actions are public endpoints.
Scan tier
Source code from source mapsRepo access (deep scan)
How to fix it
Load the user at the top of every action, check the role, and bail out when missing.