SECURITY REVIEW / Sentry
Django access review
Traces Django authorisation before flagging an IDOR, instead of matching a pattern and stopping.
“Django access control and IDOR security review. Use when reviewing Django views, DRF viewsets, ORM queries, or any Python/Django code handling user authorization. Trigger keywords: "IDOR", "access control", "authorization", "Django permissions", "object permissions", "tenant isolation", "broken access".”
01 / THE REASONING
Why this made the selection.
- The first heading is Philosophy: Investigation Over Pattern Matching.
- Later phases map the attack surface and trace a specific flow before reporting.
02 / THE REVIEW RECORD
What we actually inspected.
Source review has boundaries.
A clear record is more useful than a “safe” badge.
Material inspected
- skills/django-access-review/SKILL.md
- README.md
- LICENSE
Our findings
- Description names IDOR, tenant isolation and object permissions.
- Phase headings run from the authorisation model to Report Findings.
- The definition starts from the application authorization model and asks whether one user can access another user's data, then requires enforceable code fixes.
- High confidence is reserved for a traced flow with no check; medium confidence is manual follow-up.
- The report template includes Needs Manual Verification and Areas Not Reviewed alongside the authorization model and confirmed findings; investigation questions also cover owner assignment and bulk operations.
Not established by this review
- The skill was not executed inside a host agent.
- Not executed: it was not installed or run.
The review applies to the material and revision named here. A newer upstream release can change its behavior.
03 / PUT IT TO WORK
Add a skill to your workflow.
DOCUMENTED COMMAND
npx skills add getsentry/skills/skills/django-access-review --skill django-access-reviewRun in your terminal to choose your AI tools, project or global scope, and installation method. This short command follows the current upstream version; the review covers the revision shown above.
Optional: install the reviewed revision
Keeps the original source and installer version where recorded, while leaving your AI tools and installation scope for you to choose.
npx skills@1.7.1 add https://github.com/getsentry/skills/tree/d18b7aa8ba878354e5c348310230e652f7690f9c/skills/django-access-review --skill django-access-review- Choose your AI tools and project or global installation scope in Skills CLI. The review applies to the source revision shown on this page.
- Retain all supporting files; separately configure companion skills, runtimes and service credentials named in the definition.
- Review the resulting diff and use an isolated target before any migration, deployment, load test or warehouse operation.
Before you start
- A Django/DRF codebase with a defined ownership model and authorized review scope.
04 / FOLLOW THE EVIDENCE
The source trail.
Our notes are separate from the original resource.
Check upstream before adopting a new version.
- Skill definition ↗Checked
https://github.com/getsentry/skills/blob/d18b7aa8ba878354e5c348310230e652f7690f9c/skills/django-access-review/SKILL.md
Supports: Workflow and stated scope
- Repository licence ↗Checked
https://github.com/getsentry/skills/blob/d18b7aa8ba878354e5c348310230e652f7690f9c/LICENSE
Supports: Redistribution terms
- Install instructions ↗Checked
https://github.com/getsentry/skills/blob/d18b7aa8ba878354e5c348310230e652f7690f9c/README.md
Supports: Documented install path
https://raw.githubusercontent.com/getsentry/skills/d18b7aa8ba878354e5c348310230e652f7690f9c/skills/django-access-review/SKILL.md
Supports: review.findings, bestFor