django-access-review — Claude Code skill: Django access audit

What django-access-review does

The skill answers one question: can User A read, change or delete User B's data? It first works out how authorization is done in your codebase — decorators, middleware, base classes, permission_classes, custom managers. Then it looks for the places where that scheme breaks down.

Work runs in phases: understand the authorization model, map the attack surface, trace concrete data flows, report. It does not scan for canned vulnerable patterns. Instead it follows an ID from the URL or request body down to the ORM call and checks whether an ownership check sits in between. It greps for permission_classes, get_queryset, and owner_id or organization_id fields.

Only confirmed findings make the report, each with a confidence level. A suggested fix has to actually validate permissions and raise or return an error on denial — a comment saying the caller must check does not count. Tools are limited to Read, Grep, Glob, Bash and Task.