auth-flow-reviewerlisted

Review authentication and authorization code for exploitable gaps without touching a line of it. The skill walks the session/token model, cookie flags, CSRF defenses, token lifecycle, password-reset and email-verification flows, and OAuth parameter validation — then spends most of its effort on the part teams routinely skip: confirming that **every protected route enforces an object-level access check**. A login form that works tells you nothing about whether user A can read user B's invoice by editing an ID. Output is a findings list grouped by severity, each with a location, the concrete impact, and the fix. ## When to use this skill - Before shipping login, signup, session, JWT, or refresh-token code. - When adding a new protected route, an admin action, or a "share by link / by ID" feature — anywhere a request carries an object identifier. - Reviewing a password-reset, email-verification, or OAuth/SSO integration. - During a scheduled security pass, or after a pentest/bug report mentioning broken access control. > [!WARNING] > Authentication ≠ authorization. The most common, highest-impact real bug is a fully logged-in, legitimate user accessing another user's object (IDOR) — `GET /api/orders/123` returning order 123 to whoever asks, regardless of owner. If you only verify that login works, you will miss it. Audit the per-object check on every route, not just the session. ## Instructions 1. **Map the surface first.** Glob for routers, middleware, controllers, and gua