report

Use when browser, mobile, desktop, or WebAssembly client code reveals security-relevant API routes, request signing, feature flags, cryptographic wrappers…

Use when attacker-controlled unkeyed input may alter a shared cached response; route private-response path confusion to cache-deception.

Use when a private/dynamic authenticated response may be cached and served cross-user because cache and origin disagree about static-looking paths…

Use for feature-specific security invariants and invalid state transitions across checkout, wallet, coupon, subscription, invite, approval, refund, quota…

Use for broad permission, role, administrative function, delegation, impersonation, route-guard, middleware, feature-flag, and organization boundary…

Use for REST or GraphQL object, property, function, tenant, relationship, lifecycle, batch, export, job, and API-version authorization boundaries; do not…

Use for identity establishment and binding across login, registration, verification, reset, magic link, MFA, recovery, account linking, federation, device…

Use for source-only CI/CD review of GitHub Actions, GitLab CI, release pipelines, untrusted PR inputs, workflow permissions, token/artifact/cache trust, OIDC…

Use only when source/recon shows AWS, Azure, or GCP application boundaries involving identity, resource policy, storage, signed URLs, metadata, serverless…

Use when enumerating API surface (OpenAPI/Swagger, GraphQL introspection, versioned or undocumented endpoints) and probing API object graphs for BOLA/IDOR.

Take the attacker stance — for each surface, ask where it would break (injection, authn/authz, business logic, file handling, CSRF, SSRF) and turn the best…

Compatibility alias for authentication.