auth-securitylisted

<!-- Native skill bundle for Claude Code. Generated by `secure-vibe dev regenerate`. --> <!-- Do not edit by hand; the source of truth is skills/auth-security/SKILL.md. --> # Authentication & Authorization Security Authentication and authorization: JWT, OAuth 2.0 / OIDC, session management, CSRF, password hashing, MFA, and object-level / function-level authorization (BOLA, IDOR) — confirming the caller may access the specific resource they asked for. Use when generating login, signup, or password-reset flows, issuing or verifying JWTs, writing OAuth or OIDC code, wiring session cookies or MFA, or writing any endpoint that reads or writes a resource by id. ## ALWAYS - Authorize at the **object level** — confirm the authenticated subject actually has access to the requested resource ID, not just that they are logged in. Being signed in is not permission to read record 4,182 (OWASP API1 — BOLA / IDOR). - Bind object-level authorization to the **authenticated principal**, never to an actor id echoed in the request: checking that a request-supplied `senderId`/`ownerId`/`actedBy` is a valid member validates the *claimed* actor, not the caller (looks like authorization, isn't). - On `/{scopeId}/.../{subjectId}` routes, authorize the **relationship** — confirm the subject belongs to that scope. A caller-vs-scope check alone does not authorize the subject (multi-key BOLA). - Authorize **each subject on streaming responses** (SSE/chunked/WebSocket): the `200` is committed before th