auditing-guard-gaps

# Auditing guard gaps: the unguarded peer is the bug Most access-control and missing-validation bugs aren't exotic - they're one handler in a family that forgot the check its siblings perform. The `admin_delete` that checks a role and the `bulk_delete` that doesn't. The `read_bounded` that validates length and the `read_fast` that trusts it. Reading files top-to-bottom hides these; comparing *peers* surfaces them. This is one of the highest-yield whitebox moves. ## The asymmetry you're hunting ``` guard → sink (the intended, safe path) ??? → sink (a peer path with the guard missing - the bug) ``` ## When to use - A sink is reachable from several call sites and you suspect one skips a check. - You're auditing an authz model, a parser family, or a handler group for a forgotten check. - A finding needs its "why is this wrong" framed as a concrete diff against a correct peer. ## Scope check Authorized source only. If you can't name the authorization, stop. ## The loop 1. **Pick a guarded anchor.** Find a function that *does* validate before a sensitive sink - an authz/ownership check, a bounds check, an allowlist, a sanitizer. This is your reference for "what correct looks like here." 2. **Pin the guard to the sink it protects.** Name the exact check and the exact sink. "Correct" means the guard **dominates** the sink: on *every* path through the anchor, the check runs before the sink. Mere presence in the function is not domination. 3....