Detect missing authentication vulnerabilities

Detect missing authentication in endpoints

Finding unprotected endpoints that forgot authentication decorators or checks

• · Codebase under analysis
• · sast/architecture.md (prerequisite)

• · sast/missingauth-results.md with findings
• · Endpoints lacking auth checks

• · sast/architecture.md must exist
• · Source code accessible

• · Middleware-level auth misses endpoint protection
• · Public endpoints incorrectly flagged
• · Auth bypass makes finding moot

• · Three-phase analysis of auth decoration and enforcement
• · Distinguishes public by design from missing
• · High confidence findings per pattern