--- title: "Django access review: review, setup & limitations · Undominated.ai" canonical: https://undominated.ai/skills/getsentry-django-access-review/ description: "Traces Django authorisation before flagging an IDOR, instead of matching a pattern and stopping." --- # Django access review: review, setup & limitations · Undominated.ai > Traces Django authorisation before flagging an IDOR, instead of matching a pattern and stopping. [← Explore all skills](/skills/) SECURITY REVIEW / Sentry # Django access review Traces Django authorisation before flagging an IDOR, instead of matching a pattern and stopping. [See setup guidance ↓](#setup)[Original source ↗](https://github.com/getsentry/skills/tree/d18b7aa8ba878354e5c348310230e652f7690f9c/skills/django-access-review) SOURCE REVIEW Reviewed 2026-10-15 Evidence 4 linked sources Publisher Sentry Licence [Apache-2.0 ↗](https://github.com/getsentry/skills/blob/d18b7aa8ba878354e5c348310230e652f7690f9c/LICENSE) Revision d18b7aa8ba87 [Read what was—and wasn’t—checked ↓](#review) “Django access control and IDOR security review. Use when reviewing Django views, DRF viewsets, ORM queries, or any Python/Django code handling user authorization. Trigger keywords: "IDOR", "access control", "authorization", "Django permissions", "object permissions", "tenant isolation", "broken access".” [Sentry · upstream description ↗](https://github.com/getsentry/skills/blob/d18b7aa8ba878354e5c348310230e652f7690f9c/skills/django-access-review/SKILL.md) Our analysis follows below. 01 / THE REASONING ## Why this made the selection. - The first heading is Philosophy: Investigation Over Pattern Matching. - Later phases map the attack surface and trace a specific flow before reporting. ### A good fit for - Reviewing a Django or DRF change for object access - Refusing an IDOR comment that has not traced the real permission path - Trace cross-user and cross-tenant object operations through views, queries and permission helpers - Separate confirmed authorization gaps, manual-verification questions, and endpoints not reviewed in the report. ### Weigh up before choosing - No Django project was executed in this review. - A traced path in one app is not a tenant-isolation proof for another. - OWASP-derived reference material carries CC BY-SA 4.0 notices in addition to the repository Apache licence. Authentication alone is not object authorization. 02 / THE REVIEW RECORD ## What we actually inspected. Source review has boundaries. A clear record is more useful than a “safe” badge. ### Material inspected - skills/django-access-review/SKILL.md - README.md - LICENSE ### Our findings - Description names IDOR, tenant isolation and object permissions. - Phase headings run from the authorisation model to Report Findings. - The definition starts from the application authorization model and asks whether one user can access another user's data, then requires enforceable code fixes. - High confidence is reserved for a traced flow with no check; medium confidence is manual follow-up. - The report template includes Needs Manual Verification and Areas Not Reviewed alongside the authorization model and confirmed findings; investigation questions also cover owner assignment and bulk operations. ### Not established by this review - The skill was not executed inside a host agent. - Not executed: it was not installed or run. The review applies to the material and revision named here. A newer upstream release can change its behavior. 03 / PUT IT TO WORK ## Add a skill to your workflow. [Upstream setup instructions ↗](https://github.com/getsentry/skills/blob/d18b7aa8ba878354e5c348310230e652f7690f9c/README.md) DOCUMENTED COMMAND npx skills add getsentry/skills/skills/django-access-review --skill django-access-review Copy command ↗ Run in your terminal to choose your AI tools, project or global scope, and installation method. This short command follows the current upstream version; the review covers the revision shown above. Optional: install the reviewed revision Keeps the original source and installer version where recorded, while leaving your AI tools and installation scope for you to choose. npx skills@1.7.1 add https://github.com/getsentry/skills/tree/d18b7aa8ba878354e5c348310230e652f7690f9c/skills/django-access-review --skill django-access-review Copy reviewed-revision command ↗ - Choose your AI tools and project or global installation scope in Skills CLI. The review applies to the source revision shown on this page. - Retain all supporting files; separately configure companion skills, runtimes and service credentials named in the definition. - Review the resulting diff and use an isolated target before any migration, deployment, load test or warehouse operation. ### Before you start - A Django/DRF codebase with a defined ownership model and authorized review scope. ### Compatibility Agent Skills-compatible hosts · Django and Django REST framework ### Local Markdown instructions - Read the installed skill files - Read Django/DRF source and configuration; targeted permission tests need an authorized fixture environment. ### Cost model Source is free to read under the stated licence. A host agent may charge for use. 04 / FOLLOW THE EVIDENCE ## The source trail. Our notes are separate from the original resource. Check upstream before adopting a new version. - [Skill definition ↗](https://github.com/getsentry/skills/blob/d18b7aa8ba878354e5c348310230e652f7690f9c/skills/django-access-review/SKILL.md) Checked 2026-10-14 https://github.com/getsentry/skills/blob/d18b7aa8ba878354e5c348310230e652f7690f9c/skills/django-access-review/SKILL.md Supports: Workflow and stated scope - [Repository licence ↗](https://github.com/getsentry/skills/blob/d18b7aa8ba878354e5c348310230e652f7690f9c/LICENSE) Checked 2026-10-07 https://github.com/getsentry/skills/blob/d18b7aa8ba878354e5c348310230e652f7690f9c/LICENSE Supports: Redistribution terms - [Install instructions ↗](https://github.com/getsentry/skills/blob/d18b7aa8ba878354e5c348310230e652f7690f9c/README.md) Checked 2026-10-07 https://github.com/getsentry/skills/blob/d18b7aa8ba878354e5c348310230e652f7690f9c/README.md Supports: Documented install path - [Pinned definition review, 2026-10-15 ↗](https://raw.githubusercontent.com/getsentry/skills/d18b7aa8ba878354e5c348310230e652f7690f9c/skills/django-access-review/SKILL.md) Checked 2026-10-15 https://raw.githubusercontent.com/getsentry/skills/d18b7aa8ba878354e5c348310230e652f7690f9c/skills/django-access-review/SKILL.md Supports: review.findings, bestFor KEEP COMPARING ## Other approaches to consider. Related by category or shared topics. These are alternatives to inspect, not a measured quality order. [### Algorand vulnerability scanner ↗ Pins Trail of Bits' Algorand scanner, which treats a short or empty coverage table as an unfinished scan and does not let a clean Tealer run stand in for patterns it never examined.](/skills/trailofbits-algorand-vulnerability-scanner/)[### CodeQL ↗ Drives a CodeQL scan and warns that each Bash call is a fresh shell, so state must be written to files.](/skills/trailofbits-codeql/)[### Constant-time analysis ↗ Routes a timing review by language and says when not to use the analyzer.](/skills/trailofbits-constant-time-analysis/) [AI Tools ↗](/tools/)[Skills ↗](/skills/)[Agents ↗](/agents/)[MCP Servers ↗](/mcp-servers/)[Workflows ↗](/workflows/) ## Continue your investigation - [Choose a toolkit](/tools/) - [Inspect execution hosts](/agents/) - [Check tool access](/mcp-servers/) - [Check project dependencies](/check-repo/)