Missing Authorization (ARCH6120)

Key ruby.security.missing-authorization · Severity warning · Category security · CWE CWE-862

Exposing sensitive actions without an authentication or authorization check means any user can reach them. Guard state-changing actions.

Incorrect

class AdminController < ApplicationController
  def destroy
    User.find(params[:id]).destroy
  end
end

Correct

class AdminController < ApplicationController
  before_action :authenticate_user!
  before_action :require_admin!

  def destroy
    User.find(params[:id]).destroy
  end
end

Fix

Add before_action guards that enforce authentication and a role check on protected actions.