AuthDiff – authz change reviewer

Flag silently widened permission boundaries in your PRs before they ship

Problem

Reviewing a PR for authorization changes is nearly impossible by eye. Tweaks hide in custom guards, endpoints, RBAC/ABAC rules, and policy-as-code files, and a miss leads to broken access control or data exposure. Existing tools either lean on LLMs or skip this check entirely.

Solution

A lightweight GitHub Action that statically parses auth-related files and route decorators, then comments on the PR with every place where permission scope was widened, showing a semantic before/after diff. No LLM, fast, self-hostable, turning security review into a checklist instead of a memory game.

Users

Small-to-mid SaaS teams with compliance needs, security engineers, platform teams

MVP

Detect common auth files and decorators; only report widened-permission changes; line-anchored PR comments; allowlist ignore rules; one-command install

Revenue

Per-repo subscription for private repos, free for public, $15-49/month; enterprise self-hosted tier with audit export

Why now

Agent-generated code is flooding PRs, auth changes drown in diff noise, and manual review can no longer keep up.