111 open-source backends, by framework: where routes reach data without a guard

Every repository on the public scan page has been through the same deterministic check: it reads the routes and the tables, then asks whether a request can reach data without passing a guard. There are 111 of them now. This is the whole set cut by framework, with every report one click away.

The numbers

• 111 backends, 4,427 routes, 1,084 tables read.
• 2,800 findings: 221 errors and 2,579 warnings.
• 28 of 111 (25%) have at least one error: a route that reaches data with no authentication in front of it.
• 83 have no errors. Only 5 have no findings at all.
• The median repository has 17 routes and 12 findings.

By framework

• Express: 8 of 16 (50%). Middleware is attached route by route, so one route that forgets it is open.
• Next.js: 6 of 15 (40%). Route handlers and server actions each check the session themselves, or don't.
• NestJS: 12 of 38 (32%). Guards can be global; where they are attached per controller instead, one controller can be left out.
• FastAPI: 2 of 23 (9%). A dependency on the router covers every route under it, and most projects use one.
• SAP CAP: 0 of 19. Authorisation is declared in the service model with @requires, and the check found it in front of every route that reaches data. These repos still carry warnings.

The pattern is the obvious one, and it is worth seeing in numbers: where auth is opt-in per route, routes get missed. Where it is declared once for a whole router or service, they mostly do not.

The boards

The same list now has two boards. Hall of Fame ranks the cleanest architectures with real surface area: no errors, fewest findings, at least five routes. Most to fix ranks by errors, then findings, and every row opens a report with the route, the table, the file and line, and the fix.

Check your own

Paste a GitHub URL at wyro.in/scan, or run npx wyro-check in the repository. It is rule-based, so the same commit always gets the same answer, and one private repository is free.

• study
• security
• authentication
• open-source
• scan

Author

Dominic PaulCEO | Founder