bugbear
← the swarm
ACCESS CONTROL

CREEP

Checks every route and object reference for missing authorization.

3 findings in sample scan5 CWE classes
// WHAT IT HUNTS
  • Broken access control
  • Insecure direct object refs (IDOR)
  • Privilege escalation
  • Missing authorization checks
  • Row-Level Security (RLS) gaps
  • Client-trusted authorization
// CWE COVERAGE
CWE-862CWE-639CWE-284CWE-269CWE-732

Probes auth and authorization — broken access control, IDOR, privilege escalation.

// IN THE SAMPLE SCAN

What CREEP found in acme/api-gateway

view all in report →
CRITAdmin routes missing authorization checkroutes/admin/users.js:24 · CWE-862view →HIGHIDOR: invoice download leaks other tenantsroutes/invoices.js:37 · CWE-639view →MEDMissing ownership check on comment editroutes/comments.js:60 · CWE-284view →
Point CREEP at your code.
Every scan runs the full swarm and returns a single report.
Start a scan →
← ROTall agentsWARP →