django-access-review

django-access-review is a defensive security-review skill for finding access-control and IDOR (Insecure Direct Object Reference) vulnerabilities in Django code. It reframes the whole task around one question — can User A access, modify, or delete User B's data? — and deliberately rejects naive pattern matching in favor of investigation: understand how authorization works in this specific codebase, ask questions about concrete data flows, trace the code to where access checks do or don't happen, and report only what has been confirmed.

It guides a five-phase methodology. Phase 1 maps the authorization model (decorators, middleware, base classes, DRF permission classes, custom mixins, how querysets are scoped, and the ownership model). Phase 2 maps the attack surface (which models hold user data, which have ownership fields, which are reached by ID). Phase 3 asks the core question for each endpoint and traces where a resource ID enters, where it is used to fetch data, and what checks sit between. Phase 4 walks a concrete flow end to end with a worked DocumentViewSet IDOR example. Phase 5 reports findings with HIGH/MEDIUM/LOW confidence levels and insists that suggested fixes enforce authorization with real code, not merely document it in a comment. Bundled references cover DRF permissions, Django views, tenant isolation, and the Django ORM, and the material is based on the OWASP Cheat Sheet Series.

The target users are security engineers, code reviewers, and Django/DRF developers auditing views, viewsets, ORM queries, and multi-tenant isolation. This is defensive tooling: it uses read-oriented tools (Read, Grep, Glob, Bash, Task) to investigate authorization gaps and recommends enforcing fixes, containing no exploit payloads or offensive automation.