Permission or validation check deleted
A validation, permission or rate-limit call deleted without a replacement.
Why it matters
Guards are the lines most likely to get in an agent's way. An ownership check throws in a test fixture, a validator rejects the shape of a new field, a rate limiter trips during a manual run. Deleting the call makes the error disappear, and the rest of the code still type-checks and passes.
The result is a request that used to be rejected and now succeeds. If the removed line was an ownership or permission check, one user can now read or change another user's data. If it was validation, malformed or hostile input reaches the database. Neither shows up as a failure until someone exploits it.
Example
export async function updateProject(req: Request, id: string) {
const session = await getSession(req);
- await assertProjectOwner(session.userId, id);
const body = await req.json();
- const input = validateProjectInput(body);
- return db.project.update({ where: { id }, data: input });
+ return db.project.update({ where: { id }, data: body });
}
What it detects
- A deleted line that calls a guard-like function: names containing auth, authorize, requireAuth, getServerSession, verifyToken, csrf, rateLimit, throttle, validate, sanitize, escape, permission, isAdmin, canAccess, owner or assert.
- Not reported when the same hunk adds another guard-like call (the guard was swapped), or when the same function is still called elsewhere in the file after the change (the guard moved).
- Test files and comment lines are skipped, and at most three files are reported per run.
- It only sees that the guard left this file. A guard moved into middleware, a decorator or the caller will still be reported and needs a quick confirmation.
What to do when it fires
Find where the check went. If it moved into middleware or a wrapper that covers this handler, nothing needs to change. If it was simply deleted, restore it at the line the finding points to and fix whatever made it fail, which is usually a test fixture or a missing field rather than the guard itself.