Scanner group

Schemas and middleware

Every analyzer in this group reads one file and compares it with what a safe file would contain: a schema without the encrypted twin of a PII field, a rules file without an auth test, a middleware matcher that skips a route, an Express route with no guard. No request is sent. The evidence is a file path and the rule that fired.

5 scanners5 SASTrepository onlyup to Critical

How this group works

Five artefacts on the left, one loop in the middle. Pick a step to see the scanner read its file, apply one rule and produce a finding.

Prisma schemaschema.prisma Drizzle schemaschema.ts Firebase rulesfirestore.rules Next.js middlewaremiddleware.ts Express middlewareapp.js, middleware/ Artefact → rule → finding the shared shape Each scanner reads a file as text. It knows what a safe version of that file would contain, and the absence of that thing is the finding. what none of them do Send a request, run the code or load a database. Pick a scanner on the left to see one rule fire. the file says email String @unique (no email_hash beside it) the rule asks A field named like PII with no encrypted or hashed twin in the same model. so the twin is missing the file says api_key: text("api_key") (no api_key_encrypted column) the rule asks A column named like a secret with no protected twin in the same table. so the secret sits in plaintext the file says allow read, write: if true; the rule asks The open-rule patterns, then an auth test within three lines of every other allow. so anyone can read and write the file says matcher: ["/dashboard/:path*"] route: /api/tasks the rule asks Does any matcher regex match the route pattern? Each miss is one finding. so the route is outside the middleware the file says app.get("/api/admin/users", getUsers) the rule asks Is a known guard name among the route's own arguments? A global app.use is not. so the route has no guard Finding every finding carries severityconfidencetitlefile_path a line number only where one is known MEDIUM PII field without encryption: 'email' in model 'UserSettings' confidence 0.80 source: the repository only HIGH Secret stored in plaintext: 'api_key' in table 'users' confidence 0.90 source: the repository only CRITICAL Firebase Firestore rules allow unrestricted access confidence 0.95 source: the repository only MEDIUM API route not covered by auth middleware confidence 0.85 source: the repository only MEDIUM Express route '/api/admin/users' has no auth middleware confidence 0.85 source: the repository only

1Five analyzers, one shape. Each reads a repository file as text, knows what a safe version would contain, and reports the absence. No request is sent and no code is run, so the evidence is always a file path and the rule that fired.

2Prisma schema. A field named like personal data, with no _encrypted, _hash or _hashed twin in the same model. The same rule family finds plaintext secrets, missing tenant columns and payment IDs.

3Drizzle schema. The same checks on pgTable definitions, run on the quoted column name. api_key is a secret name and no protected twin exists.

4Firebase rules. The rules file is the whole server-side access control. allow read, write: if true is matched by pattern: Critical, the highest severity in this group.

5Next.js middleware. The matcher list is compared with the routes found in the repository. A route no matcher reaches skips the auth check, and each such route is a finding.

6Express middleware. Express has no matcher, so each route line is read for a guard among its own arguments. A route with none, on a sensitive path, is a finding.

Scanners in this group

model User {id Stringemail String

Prisma schema

Four field checks on schema.prisma, and the camelCase spellings that decide what the matcher can see.

SASTLow to Highprisma-schema-analyzer.md
pgTable("users", {api_key: text(tenant_id: —})

Drizzle schema

The same checks on pgTable definitions, run on the database column name, plus the tenant check across tables.

SASTLow to Highdrizzle-schema-analyzer.md
match /users/{id} {allow read, write:if true;}

Firebase rules

Open rules, missing auth tests and wildcards, line by line, and one rule evaluated against a request.

SASTMedium to Criticalfirebase-rules-analyzer.md
matcher /api/:path*/api/tasks/api/admincoverednot covered

Next.js middleware

A matcher laid over the route tree: which API routes fall outside it, and which matcher shapes hide them.

SASTLow to Highmiddleware-analyzer.md
app.get("/admin", getUsers)app.get("/admin", requireAuth, ...)

Express middleware

Routes without a guard in their own arguments, weak token checks, and rate limit, header, CORS and tenant checks.

SASTLow to Highexpress-middleware-analyzer.md

At a glance

ScannerWhat it looks atWhat it reportsSeverityNeeds
Prisma schema analyzerEvery model block in schema.prismaSecret fields, PII without an encrypted twin, models without tenant_id, payment provider IDsLow to HighRepository
Drizzle schema analyzerEvery pgTable, mysqlTable or sqliteTable call, by column db_nameThe same four findings as PrismaLow to HighRepository
Firebase rules analyzerfirestore.rules, storage.rules, database.rules.jsonOpen rules, allow lines with no auth test, broad wildcardsMedium to CriticalRepository
Middleware analyzermiddleware.ts or .js and the Next.js API route listNo middleware, routes outside the matcher, weak token check, bypassable matcherLow to HighRepository
Express middleware analyzerExpress route lines and middleware filesRoutes without a guard, weak or missing auth middleware, rate limit, headers, CORS, tenant isolationLow to HighRepository; Express detected

Why this class matters

Why it matters

These files decide who can do what before any request arrives, so a mistake in them is a mistake in every request. A schema decides how much a leak exposes. A rules file is the server-side access control for Firebase. A middleware matcher or a route list decides which endpoints are ever asked who is calling.

Real-world breaches

GitHub (2012). A Rails mass assignment bug let an attacker add his SSH key to the Rails core repository through a field on the model. Comparitech (2020) found 24,000 Android apps with misconfigured Firebase databases leaking emails, passwords and health data. Optus (2022) exposed 9.8 million records through an API endpoint with no authentication, and Peloton (2021) exposed user data through unauthenticated API endpoints.