What to inspect
- login, register, logout, refresh, and session routes
- role checks
- ownership checks on
[id]routes - password reset and recovery flows
- session creation, invalidation, rotation, and cookie flags
- JWT creation, signing, expiry, audience, issuer, and verification logic
- API key storage and response serialization
- plaintext secrets or default credentials in repo, docs, env examples, or logs
Questions to answer
- Are server-side authz checks present at the data or mutation boundary?
- Can one user access another user's resource by ID?
- Is password reset resistant to enumeration and guessing?
- Are JWTs verified with the correct algorithm, claims, and key handling?
- Are secrets encrypted, masked, and omitted from responses?
Evidence format
For each result, record:
- asset being protected
- guard in place
- bypass possibility
- session or token weakness
- data exposure status
Common non-findings
- server-side ownership checks enforced before database mutation
- JWT verification that pins algorithm and validates issuer and audience
- secrets stored only in environment variables and never serialized to clients