Hunter Agent: Access Control, Business Logic, and Auth Guide

Quick answer

SonarQube Hunter Agent documents one playbook spanning three intent-based categories: broken access control, business-logic flaws, and authentication or session gaps. Evaluate it with known positive cases, negative controls, and representative application code—not only an unseeded scan.

For each finding, preserve the scanned commit and path, then verify asset reachability, identity and state preconditions, exploitability, impact, severity, remediation, regression, and independent AppSec approval.

1. Broken access control

Sonar lists examples including IDOR, missing or incorrect authorization checks, privilege escalation, sensitive-data exposure, and cross-site request forgery.

Build cases across:

• object ownership and cross-tenant identifiers;
• role, permission, group, and account-team changes;
• field-level and relationship-level access;
• server-side enforcement after UI controls are bypassed;
• export, search, bulk, background-job, and alternate API paths;
• state-changing requests and anti-CSRF protections.

Every positive case needs a paired negative control. A legitimate administrator path should not be flagged merely because it accesses another user’s record, while a standard user must be denied even if an identifier is guessed correctly.

2. Business-logic flaws

Sonar names skipped workflow steps, repeatable-action abuse, and missing rate limits. Tie each test to a business invariant:

Invariant	Abuse case	Regression evidence
One discount per eligible order	Replay, stacking, concurrency	Atomic eligibility and duplicate test
Payment before fulfillment	Skip or reorder workflow state	Server-side state-machine test
One recovery action per window	Parallel and distributed retries	Rate and identity-scope test
Credit cannot exceed balance	Negative, rounding, partial-failure values	Ledger and rollback test
Approval before material action	Alternate endpoint or background path	Authorization and approval-state test

Include retries, idempotency, race conditions, stale state, partial completion, timezone or currency boundaries, and cross-service workflows. Full-codebase reasoning is most useful when the invariant spans multiple files and components, but a reviewer still must confirm how the deployed system behaves.

3. Authentication and sessions

The product page lists broken authentication, session fixation, non-expiring sessions, weak password recovery, missing MFA, brute-force gaps, and representative CWEs.

Test account creation, login, MFA enrollment and recovery, password reset, email or phone change, device trust, token refresh, logout, global revocation, privilege change, impersonation, support recovery, and deleted or suspended users. Include multiple devices, concurrent sessions, old tokens, rotated keys, timeouts, and cross-tenant identity.

Do not infer runtime cookie, proxy, identity-provider, or cloud configuration from source analysis alone. Pair code findings with deployed configuration inspection and end-to-end security tests.

Design the evaluation corpus

Create a versioned corpus with:

1. representative true positives for each class;
2. secure implementations that resemble the vulnerable pattern;
3. previously fixed production findings and their regression tests;
4. framework, language, monorepo, generated-code, and service-boundary examples;
5. cases requiring business context that is not obvious from names alone;
6. deployed-only failures reserved for external testing.

Score finding validity, class, root cause, location, explanation, severity agreement, overlap with other tools, review time, fix quality, and missed cases. Keep source confidentiality and vendor data handling within the approved contract.

Use the GA guide for lifecycle, the SAST and pentest comparison for coverage boundaries, and the readiness check for operating evidence.

Frequently asked questions

Which classes does Hunter Agent document?

Broken access control, business-logic flaws, and authentication or session-management gaps.

What is a broken access-control test case?

Use cross-tenant object access, missing ownership checks, privilege escalation, hidden-field exposure, and unauthorized state changes with paired allowed and denied identities.

What is a business-logic test case?

Use workflow bypass, repeated discounts or credits, missing rate limits, replay, invalid state transitions, concurrency, and partial-failure cases tied to an explicit invariant.

How should a confirmed finding be closed?

Verify exploitability and impact, fix the root cause, add regression tests, deploy, retest independently, and record residual risk and closure approval.

Official sources

• Sonar: Hunter Agent product page and vulnerability classes
• Sonar: Hunter Agent GA announcement

Source check: August 29, 2026. CWE examples on the product page are representative, not exhaustive; verify current playbooks and actual project coverage.