How to shift-left and find critical authorization vulnerabilities throughout your CI/CD Pipeline?

The talk covers broken authorization, where a logged-in user reaches data or actions meant for another user or a higher role. The speakers note that these flaws rank among the most critical and common bug bounty findings and are hard to detect at scale. They cite a recent GitLab CODEOWNERS bypass as an example and frame the work around defining policies, monitoring them, and testing that code enforces them.

The middle covers a staged approach. During API design, teams should list resources, roles and permissions, then keep access policies separate from implementation so tooling can flag endpoints lacking a policy before merge. In staging, automated tests can create objects under a victim account and try to read or change them from an attacker account, which catches object-level flaws. The speakers extend this to role, permission and plan checks, comparing a documented access table against live responses. For permissions, they recommend starting from a user with no rights and adding them one at a time. They also flag token automation as a practical obstacle when logins involve SSO, one-time passwords or magic links.

The closing part covers production monitoring for access spikes and brute-force patterns, and a combined setup where a dynamic scanner in staging sends malicious requests while runtime alerts flag successful exploits. The main takeaway is to build an authorization matrix early, automate checks for every role and plan, and fail the pipeline whenever a restricted call succeeds.