AAuthZGuard View repository

Defensive authorization verification

Prove access rules.
Protect the boundary.

AuthZGuard verifies declared API authorization expectations only in environments you are explicitly authorized to test. It helps teams capture minimal evidence and hand over remediation-ready reports—without turning validation into exploitation.

Start locally Explore the workflow

No remote scan runs from this page. The CLI requires an explicit scope file, operator-supplied test identities, and an authorization attestation.

01

Scope before requests

Every target begins with an explicit allowlist and attestation. Private-address and DNS checks reduce accidental reach beyond the intended environment.

02

Evidence, not exploitation

Validation compares declared expectations with observed status codes while retaining minimal evidence rather than response content.

03

Reports teams can act on

Markdown, JSON, JUnit, and SARIF outputs put clear remediation context into developer and security workflows.

Controlled workflow

Four deliberate steps.
One accountable outcome.

  1. 01

    Declare approved scope

    List only the hosts and base URLs authorized by the system owner. Targets outside the declared scope are rejected.

  2. 02

    Describe expected access

    Use a YAML matrix to express which operator-provided test role should receive which status for each approved route.

  3. 03

    Validate with restraint

    The guard uses low-impact, non-mutating request rules, enforced spacing, and minimal response evidence.

  4. 04

    Hand off a fix-ready report

    Export an auditable report for the development or IT team, then verify the remediation in the same approved environment.

Static demonstration

Configuration in.
Remediation context out.

This is a presentation-only preview. It does not send requests, store credentials, or validate any real system.

scope.approved.yaml
authorization:
  attestation: I_HAVE_WRITTEN_AUTHORIZATION
  reference: "STAGING-CHANGE-2026-08"
request_policy:
  minimum_interval_ms: 750
targets:
  - base_url: https://api.example.internal
    allow_private_network: false
    allow_authorized_public_target: false

Credentials belong in environment variables controlled by the authorized operator—never in this file.

remediation-summary.md1 finding

AUTHORIZATION EXPECTATION MISMATCH

Support role received 200 where 403 was declared

Route
GET /v1/billing/export
Expected
403 Forbidden
Observed
200 OK

Remediation direction: enforce server-side role checks on the export handler, then add the declared expectation to CI.

Evidence records request metadata and status only; it does not collect response bodies.

Non-negotiable boundary

Authorized systems.
Defensive outcomes.

AuthZGuard is for system owners, security teams, and researchers with explicit written permission. It is not a discovery scanner, does not automate exploit chains, and must not be used against public targets or systems outside an approved scope.

Read the responsible-use policy

Open source · Python · GitHub Action

Make authorization
regressions visible.

Open AuthZGuard