Find API routes anyone can call without signing in
For anyone shipping a web app a coding agent helped build: find the API routes and server actions that strangers can call without signing in, before someone else does. Lists every route in Next.js, SvelteKit, Express, or Hono code, flags writes with no auth check, webhooks that skip signature checks, admin routes with no role check, and ids that let one user reach another user's records, then drafts the fixes for you to approve. Reads code only; never sends a request.
- Activity
- New: be the first to try it
- Installs
- 0 installs
- Likes
- 0 likes
- Clones
- 0 clones
How this works
- It is a skill: written instructions Claude reads when your request matches what the skill is for. You do not call it by name; just ask for the task.
- While it works, it reads and changes files in the places it lists, nowhere else.
- It runs these commands on your computer: node scripts/route-auth-scan.mjs.
- Nothing runs until you choose to use it, and you can remove it any time.
What it can access
What this kit declares, in the same words the CLI shows before you install. On Claude Code the CLI turns these into permission rules, so the agent stops anything undeclared.
Command
Runs the command: node scripts/route-auth-scan.mjs (with any arguments, without asking)
Reads
Reads files in ./**