Scan rule · RSC-SEC-059
API route without an access check
SecuritySeverity: HighCWE-862OWASP A01-2021
Finds route handlers with mutating methods that contain no authentication.
Scan tier
Source code from source mapsRepo access (deep scan)
How to fix it
Verify the session server-side and answer 401 without a valid identity.