VBC-942: missing-access-control

warning

Category: security
Analysis: Regex (line by line)
File types: .js, .ts, .tsx, .astro
Scope: source code only, ignoring anything inside strings and comments
Tags: security ai-error

What it reports

Route handler at line {line} may be missing authentication middleware. AI-generated route handlers frequently omit auth guards. Ensure every non-public endpoint is protected with authentication and authorization middleware before the handler runs.

Flagged

router.get('/users', async (req, res) => res.json(users));

Not flagged

router.get('/users', requireAuth, async (req, res) => res.json(users));

Pattern

(?:router|app)\.(?:get|post|put|delete|patch)\s*\(\s*['\"][^'\"]+['\"]\s*,\s*(?:async\s+)?\(?\s*(?:req|request)\b[^)]*\)?\s*(?:=>|\{)