laravel-authorization-reviewlisted

# Laravel Authorization Review > SAST tells you where data flows. This tells you where it flows to the **wrong user**. This skill is the judgment layer for the one category automated scanners structurally cannot do: **broken object-level authorization (IDOR / BOLA)** — #1 in the OWASP API Security Top 10. Taint scanners trace untrusted *input*; they cannot decide whether `Order::find($id)` *should* have been scoped to the current user. That is a question about **intent**, reasoned across middleware, controller, policy, and query. The skill is trustworthy because every finding traces to a **ground-truth anchor**: `php artisan route:list --json` is the deterministic inventory of every endpoint and its merged middleware. If you cannot point to both a real route **and** a cited `file:line`, you do not report it. --- ## Constraints - Apply `@rules/php/core-standards.mdc` - Apply `@rules/laravel/laravel.mdc` and `@rules/laravel/architecture.mdc` - Apply `@rules/security/backend.md` — *Database* (authentication & authorization, least privilege) and *Safe Validation & Error Messages* (a 403-vs-404 distinction that confirms a resource exists is itself an authorization-granularity leak) - Apply `@rules/code-review/general.mdc` — map every finding onto the CR severity scale (Critical / Moderate / Minor) so this skill plugs into a Laravel CR run - **Advise-only.** Reads files and runs one read-only command (`php artisan route:list --json`). Never edits routes, controllers, policies,