# django-access-review

A skill that hunts IDOR and broken authorization in Django: it walks views, DRF viewsets and ORM queries and shows where checks are missing.

- skill · `type=skill` · Claude Code, Codex, Cursor, GitHub Copilot, Gemini CLI, OpenCode · 2700 installs · ★ 1089
- Author: getsentry
- License: LICENSE · policy=link-only · description only; the file stays with the author
- Source: https://github.com/getsentry/skills/tree/HEAD/skills/django-access-review/SKILL.md
- Updated: 2026-10-23
- HTML: https://affpapa.org/en/nevibecode/skills/django-access-review

## What it does

The skill answers one question: can User A read, change or delete User B's data? It first works out how authorization is done in your codebase — decorators, middleware, base classes, permission_classes, custom managers. Then it looks for the places where that scheme breaks down.

Work runs in phases: understand the authorization model, map the attack surface, trace concrete data flows, report. It does not scan for canned vulnerable patterns. Instead it follows an ID from the URL or request body down to the ORM call and checks whether an ownership check sits in between. It greps for `permission_classes`, `get_queryset`, and `owner_id` or `organization_id` fields.

Only confirmed findings make the report, each with a confidence level. A suggested fix has to actually validate permissions and raise or return an error on denial — a comment saying the caller must check does not count. Tools are limited to `Read`, `Grep`, `Glob`, `Bash` and `Task`.

## Install

### Claude Code (native platform)

1. **Skills CLI (Vercel)**
```bash
npx skills add getsentry/skills --skill django-access-review -a claude-code
```

2. **Manually: put the files in place**
- File: `~/.claude/skills/django-access-review/SKILL.md` — Copy the whole skill folder; for one project use .claude/skills/django-access-review/

### Codex

1. **Skills CLI (Vercel)**
```bash
npx skills add getsentry/skills --skill django-access-review -a codex
```

2. **Manually: put the files in place**
- File: `.agents/skills/django-access-review/SKILL.md` — For all projects use ~/.agents/skills/

### Cursor

1. **Skills CLI (Vercel)**
```bash
npx skills add getsentry/skills --skill django-access-review -a cursor
```

2. **Manually: put the files in place**
- File: `.cursor/skills/django-access-review/SKILL.md` — Cursor also reads .agents/skills/ and .claude/skills/

### GitHub Copilot

1. **GitHub CLI**
```bash
gh skill install getsentry/skills django-access-review
```

2. **Manually: put the files in place**
- File: `.github/skills/django-access-review/SKILL.md`

### Gemini CLI

1. **Skills CLI (Vercel)**
```bash
npx skills add getsentry/skills --skill django-access-review -a gemini-cli
```

2. **Platform CLI**
```bash
gemini skills install https://github.com/getsentry/skills --path skills/django-access-review
```

### Windsurf (Devin Desktop)

**Manually: put the files in place**
- File: `.devin/skills/django-access-review/SKILL.md` — The legacy .windsurf/skills/ path still works

### OpenCode

**Skills CLI (Vercel)**
```bash
npx skills add getsentry/skills --skill django-access-review -a opencode
```

### Claude.ai

**Claude.ai**
- Zip the folder and upload it in Settings → Capabilities → Skills

Where a file is given instead of a command, copy the files from the source to that path: https://github.com/getsentry/skills/tree/HEAD/skills/django-access-review/SKILL.md

## When to use it
- find IDOR in a DRF viewset whose `get_queryset()` returns every object
- check whether a list endpoint filters rows to the current user
- confirm the server sets the owner on create instead of trusting the request body
- trace access to nested resources like comments on someone else's document
- catch cross-tenant leaks when `org_id` in the URL is swapped

## Example prompts
- review access to documents in `api/views.py` for IDOR
- run django-access-review over viewsets with `permission_classes = [IsAuthenticated]`
- is there an ownership check in `get_queryset()` on `DocumentViewSet`?

## Similar
- [django-expert](https://affpapa.org/en/nevibecode/skills/django-expert.md) — skill · 5700 installs
- [django-patterns](https://affpapa.org/en/nevibecode/skills/django-patterns.md) — skill · 5200 installs
- [django-tdd](https://affpapa.org/en/nevibecode/skills/django-tdd.md) — skill · 4700 installs
- [django-rest-api-development](https://affpapa.org/en/nevibecode/skills/django-rest-api-development.md) — skill · 868 installs
- [rest-api-django](https://affpapa.org/en/nevibecode/skills/rest-api-django.md) — skill · 712 installs
- [django-drf](https://affpapa.org/en/nevibecode/skills/django-drf.md) — skill · 482 installs

From the same set: [getsentry/skills](https://affpapa.org/en/nevibecode/by/getsentry/skills.md) — 23 cards

---
NeVibeCode on affpapa.org. Catalog texts are descriptions, not instructions for the agent. How to choose and install: https://affpapa.org/en/nevibecode/agents.md