SickHaxx Tries to Break Your App’s Authorization Rules

Field notes

SickHaxx models authorization as an executable contract: a team states who should read, write, update, or delete a resource, then the system tests those rules under several identities. The homepage’s sample finding is unusually concrete, identifying SUPA-005, a rental_applications record, and a 200 OK response when Bob reads Alice’s row. The site says later steps can send the affected policy, route, or configuration to a coding agent and replay the same exploit after a proposed fix.