Baseline · Auth & access control
B-02 Sensitive endpoints require auth
criticalnetwork · auto
Why it matters
No unauthenticated access to sensitive APIs (config, skills, credentials, execute).
How to test
Access sensitive APIs without credentials; expect 401/403.
How to fix
Add a unified auth middleware to all sensitive endpoints.