# authz pre-scan — broken access control / BOLA signatures

- **HIGH** `AUTHZ-ADMIN-NO-ROLE` — hostile/routes.js:6 — /admin route registered in a file with no admin/role gate vocabulary
- **HIGH** `AUTHZ-OBJECT-NO-OWNER` — hostile/routes.js:11 — object fetched/mutated by client-supplied id with no ownership predicate in the handler — BOLA/IDOR shape
- **HIGH** `AUTHZ-ROLE-FROM-REQ` — hostile/routes.js:16 — role/permission key read from request input — caller chooses own privilege level
- **HIGH** `AUTHZ-REQ-IDENTITY` — hostile/routes.js:21 — identity/tenant key read from request input — acting-as is client-controlled; feeds a data sink
- **HIGH** `AUTHZ-REQ-IDENTITY` — hostile/routes.js:27 — identity/tenant key read from request input — acting-as is client-controlled; feeds a data sink
- **MEDIUM** `AUTHZ-ROLE-FROM-REQ` — clean/orders.js:25 — role/permission key read from request input — caller chooses own privilege level
- **MEDIUM** `AUTHZ-ADMIN-NO-ROLE` — hostile/routes.js:5 — /admin route registered in a file with no admin/role gate vocabulary
- **MEDIUM** `AUTHZ-MUTATING-NO-AUTH` — hostile/routes.js:7 — mutating route in a file with zero auth vocabulary
- **LOW** `AUTHZ-SENSITIVE-ROUTE` — hostile/routes.js:8 — debug/internal route path mounted — often leaks state or skips auth

Files scanned: 2 — 5 HIGH / 3 MEDIUM / 1 LOW / 0 INFO

Pre-scan only — middleware in other files, framework guards, and runtime policy are invisible to it.