I Automated OWASP Top 10 Checks With a Pre-Commit Hook

Broken Access Control has been OWASP #1 since 2021. Not because developers don't understand authentication — but because auth is a consistency problem. Your auth can be perfect on 99 endpoints. Endpoint 100 ships without middleware because someone forgot, copied a route template that didn't include it, or added an "admin-only" page during a hackathon and never locked it down. Most auth tooling is runtime: pentest frameworks, DAST scanners, bug bounties. By the time they find something, the code is deployed and the vulnerability is live. I wanted a pre-commit hook that catches the common stuff before it leaves the developer's machine. So I built one. How AuthAudit Maps to OWASP AuthAudit scans for 90 authentication and authorization anti-patterns across 6 categories. Every finding maps to an OWASP Top 10 2021 entry: OWASP Category AuthAudit Coverage A01:2021 Broken Access Control Missing auth middleware, IDOR patterns, frontend-only role checks A02:2021 Cryptographic Failures Weak hashi