Credentials
weak hashing (MD5/SHA1/unsalted), no rate limit or lockout, user enumeration via messages or timing.
The pack · 03 / 14 →
Auth
Doberman
the auth dog. Guards the front door: login, OAuth/OIDC, sessions, password reset, MFA, JWTs and SSO.
jwt.ts
12export function verify(token: string) {
13 return jwt.decode(token); return jwt.verify(token, KEY, { algorithms: ["RS256"] });
14}
15
16app.use(auth(verify));
JWT never verified
ExploitForge a token and log in as any user
FixSmallest change suggested
Doberman is watching$ /watchdog-go-auth0 found · 0 fixed
What it does
On duty while you build.
The auth dog. Guards the front door: login, OAuth/OIDC, sessions, password reset, MFA, JWTs and SSO.
The always-on lens watches login, signup, OAuth, OIDC, SAML, sessions, cookies, JWT, password reset, MFA.
What it checks
7 things Doberman looks for.
Sessions
cookies without Secure/HttpOnly/SameSite, no rotation on login, no server-side logout, long-lived tokens.
JWT
decode without verify, `alg: none`/HS-RS confusion, no expiry, secrets in code.
OAuth/OIDC
missing `state`/PKCE, open redirect_uri, token in URL fragment logs, id_token not validated (iss/aud/nonce).
Password reset
guessable or non-expiring tokens, token in response, no invalidation after use.
MFA
bypassable step, recovery codes in plaintext, MFA not enforced on sensitive actions.
Account linking and SSO
email-based auto-linking, unverified emails trusted.
Commands
Send Doberman out.
Runs these scanners when installed, then reads the code they can't understand:
- semgrep
Login, OAuth/OIDC, sessions, password reset, MFA, JWT, SSO
- /watchdog-go-web
- /watchdog-go-mobile
- /watchdog-go-marketplace
- /watchdog-go-all
Also runs in these bundles.
Benchmark
Tested, not promised.
Its test target holds an Express auth service (login, MFA, OAuth, reset, SAML SSO, JWT): 18 planted issues, 3 decoys and an answer key.
found
Haiku 5.518/18
Sonnet 5.518/18
Opus 5.518/18
Rules of engagement
What Doberman will never do.
- 1
Static review only. Never change live systems or send traffic to targets outside the user's written scope.
- 2
Never print a secret's value — not keys, tokens or passwords, even weak defaults. Give file:line and the secret type only.
- 3
End each review with: what you did not check, and the top risk the user must act on.
FAQ
Doberman, answered.
What does Doberman check for?
Doberman is Watchdog's auth dog for Claude Code. It looks for Credentials, Sessions, JWT, OAuth/OIDC, Password reset, MFA and Account linking and SSO. Each finding comes with the exact file and line, how it could be abused, and the smallest fix.
How do I run Doberman in Claude Code?
Install Watchdog with /plugin marketplace add watchdoglab/watchdog and /plugin install watchdog@watchdog, then run /watchdog-go-auth. Its lens also stays on while you code and flags risky lines as they're written.
Which tools does Doberman use?
When they're installed, Doberman runs semgrep, then reads the code those scanners can't understand. Anything it couldn't check is listed under Not checked in the report.
Is Doberman safe to run on my project?
Yes. Its first rule: Static review only. Never change live systems or send traffic to targets outside the user's written scope. Secrets it finds are reported by location and type only, never printed. Watchdog is free and open source (MIT).