missing_auth_check

Add authentication middleware / decorator to the route trivial effort

// Express / NestJS
router.get("/admin", requireAuth, handler);
@Get("/admin")
@UseGuards(AuthGuard)
adminRoute() { ... }

// Spring
@PreAuthorize("isAuthenticated()")
@GetMapping("/admin")
public Admin getAdmin() { ... }

// Django (function view)
@login_required
def admin_view(request): ...

// Flask
@app.route("/admin")
@login_required
def admin(): ...

// Rails
class AdminController < ApplicationController
  before_action :authenticate_user!
end

Apply auth at router/blueprint/controller scope when many routes share the same policy low effort

// Express: router.use(auth) applies to all subsequent routes
const adminRouter = express.Router();
adminRouter.use(requireAuth);
adminRouter.get("/", listAdmins);
adminRouter.post("/", createAdmin);

Suppress a confirmed non-issue with a committed .pullguardignore entry (pullguard ignore locally, or comment /pullguard ignore <fingerprint> <reason> on the PR — the fingerprint is printed in the PR comment’s Triage section). Entries support expiresAt for time-boxed snoozes.

Security findings at major or critical severity — and any critical finding — always surface: .pullguardignore cannot hide them. The reviewed paths that keep them visible are acknowledged (reviewed, stays in reports) and, for a confirmed false positive, a reasoned false_positive entry — visible and audited, excluded only from the merge block.