Hacktoberfest 2026: the issues maintainers tagged for October, open and beginner-friendly. Browse Hacktoberfest issues

fix(skill): ownership check graded must when sibling checks are out of view

Open
  • Is something wrong?
#12 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Assessment

Difficulty
3/5
Estimated time
1-2 days
Newbie friendliness
68/100
Issue type
Bug
Clarity
Clearly specified
Activity status
Active
Tech stack
javascript
Domain
devtools, security

Research direction

Start by reading SKILL.md and security.md, then inspect the dotnet eval fixture and expected.md mentioned in the issue. Update the access-control guidance so findings without visible ownership evidence go under Questions, and run the dotnet eval three consecutive times. Done when those runs pass and the dotnet-webhook and nestjs findings retain their previous grades.

Written by the indexing model from the issue text.

Description

bug eval

What

On the dotnet fixture the review grades a missing ownership check (IDOR) on a new endpoint as must, while expected.md asks for a question unless sibling endpoints visibly check ownership.

Why

It is the one false positive in the v0.2.0 eval runs. A must on an assumption about unseen code breaks the "proof or it's dropped" rule.

Acceptance criteria

  • SKILL.md and security.md say that an access-control finding needs either a visible sibling that checks ownership or a visible data model that ties the resource to the caller; otherwise it goes under Questions.
  • The dotnet eval reports it under Questions in three consecutive runs.
  • The dotnet-webhook and nestjs access-control findings stay graded as before.
Dominant language
JavaScript
Stars
0
Forks
0
No merged PRs in 30d

Getting set up

This project ships no dev container, Dockerfile or contributing guide, so setting up is up to you: start from its README, and see our first-contribution guide for the general steps.

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from devmaxxx/stackwise

All issues in devmaxxx/stackwise

Similar issues

More JavaScript issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.