Backend invariants,
enforced.
Every backend has unwritten rules. Authorization checks. Rate limits. Tenant isolation. These rules live in your team's heads — until someone forgets. We enforce them automatically.
$ npx @securitychecks/cli scanThe invariants that matter
These aren't theoretical vulnerabilities. They're the production bugs that pass code review and unit tests — but cause incidents on day one.
Fired employee retains access
Sarah was terminated last Friday, but she can still access customer data.
Root Cause
Membership deletion doesn't invalidate the cached permissions.
The Bug
// removeMember deletes from DB but cache stays valid
await db.membership.delete({ where: { userId } });
// BUG: cache.invalidate() never calledCaught by: AUTHZ.MEMBERSHIP.REVOCATION.IMMEDIATE
Double-charge on webhook retry
Customers are getting charged twice when Stripe retries the payment webhook.
Root Cause
Webhook handler processes events without checking if already handled.
The Bug
// Stripe retries webhooks, this runs multiple times
async function handlePayment(event) {
// BUG: No idempotency key check
await db.payment.create({ amount: event.amount });
}Caught by: WEBHOOK.IDEMPOTENT
Cross-tenant data leak
User A can see User B's private documents by guessing the document ID.
Root Cause
API endpoint fetches by ID without checking tenant ownership.
The Bug
// Document fetch without ownership check
async function getDocument(req) {
const doc = await db.document.findUnique({
where: { id: req.params.id }
// BUG: No organizationId filter
});
}Caught by: AUTHZ.TENANT.ISOLATION
Every finding comes with evidence.
We don't just tell you something's wrong — we show you the exact file, line, and code path that proves it.
Works with your stack
The invariants that break in production.
These pass code review. They pass unit tests. But they cause incidents because they violate architectural assumptions your codebase depends on.
AUTHZ.SERVICE_LAYER"What happens when a background job calls this directly?"
Authorization at Service Layer
Auth middleware protects routes, but service functions are often called directly. We catch unprotected service calls.
WEBHOOK.IDEMPOTENT"What happens when Stripe retries this three times?"
Idempotent Webhooks
Webhook handlers that process events without checking if already handled will double-charge customers on retry.
TRANSACTION.SIDE_EFFECTS"Did we send an email before the transaction committed?"
Transaction Side Effects
Side effects inside transactions cause inconsistent state on rollback. We find emails sent before commits.
CACHE.AUTH_INVALIDATION"When permissions change, does the cache know?"
Cache Invalidation on Auth Changes
Caching improves performance, but stale permission caches let fired employees keep access. We trace invalidation paths.
AUTHZ.MEMBERSHIP.REVOCATION"If I remove someone now, can they still access team resources?"
Membership Revocation
Membership deletion must invalidate sessions and caches immediately. Delayed revocation is a security gap.
These aren't edge cases. They're the bugs that pass code review every day.
$ npm install -g @securitychecks/cli && scheck runIntegrate in Minutes, Not Days
Whether you prefer CLI, CI/CD, or dashboard—we've got you covered with flexible integration options.
One Command, Instant Insights
Run security checks locally or in CI/CD with a single command. Get detailed reports with actionable findings.
$ npm install -g @securitychecks/cli && scheck runScanning codebase...✓ Loaded 847 source files✓ Detected framework: Next.js 15✓ Applied 23 framework-specific rulesFindings: P0 (Critical) 2 issues P1 (High) 5 issues P2 (Medium) 12 issuesTop Issues: ✗ AUTHZ.SERVICE_LAYER.ENFORCED - src/app/api/users/route.ts:24 Authorization check at route level, not service layer ✗ WEBHOOK.IDEMPOTENT - src/webhooks/stripe.ts:45 No idempotency key check before processingView full report: https://app.securitychecks.ai/scans/abc123Free to start. No credit card required.
Enforce the backend rules your codebase assumes but doesn't verify.
Authorization gaps. Missing rate limits. Broken tenant isolation.
$ npm install -g @securitychecks/cli && scheck runYour code never leaves your machine. Only structural facts are analyzed in the cloud.