Why is investigation preferred over pattern matching?

Because every Django codebase implements authorization differently (mixins, middleware, or custom managers), a flow-based investigation is more accurate than simple regex-based scanning for finding logic flaws.

What is an IDOR vulnerability in Django?

Insecure Direct Object Reference (IDOR) occurs when a Django view uses user-supplied input (like a PK in a URL) to access a model instance without verifying if the current user has permission to view or modify that specific object.

Does it provide automated fixes?

It suggests specific code-based remediations that enforce authorization logic (like adding permission checks or scoped filters) rather than just providing documentation or comments.

Does this skill support Django REST Framework (DRF)?

Yes, it is specifically optimized for DRF, including checks for permission_classes, has_object_permission() implementations, and get_queryset() overrides.

How does this skill detect multi-tenant data leaks?

It investigates the ownership model of the application and traces how IDs from request bodies or URLs are used in ORM queries, looking for missing filters that should scope data to a specific user or organization.

Django Access Control Review: Claude Code Skill Security

The Django Access Control Reviewer skill provides a structured methodology for auditing Django and Django REST Framework (DRF) codebases for critical authorization flaws. Instead of simple pattern matching, it guides Claude through a multi-phase investigation: understanding the specific authorization model (middleware, decorators, or mixins), mapping sensitive endpoints, and tracing data flows from request to database. It is designed to confirm whether User A can access User B's data by analyzing ORM scoping, permission classes, and custom managers, ultimately providing actionable code-based remediations to ensure robust tenant isolation and object-level security.

Características Principales

01118 GitHub stars

02Analysis of Django REST Framework (DRF) permission classes and viewsets

03Actionable, enforcement-first code remediation suggestions

04Identification of insecure data fetching patterns in views and decorators

05Deep code tracing for Insecure Direct Object Reference (IDOR) vulnerabilities

06Review of custom QuerySet scoping and model managers for tenant isolation

Casos de Uso

01Identifying missing ownership checks in legacy Python/Django views and custom managers

02Reviewing complex DRF ViewSets to verify object-level permissions are correctly implemented

03Auditing a multi-tenant Django API to ensure users cannot access other organizations' data

What are Skills?·How to Install

Install with 🐟 Skill.Fish

npx skillfish add getsentry/dotagents django-access-review

For use in Claude.ai and ChatGPT

Download Skill