AdminTagger
Flags administrative / privileged endpoints. These are high-value targets for broken access control, privilege escalation, and forced browsing — surfacing them tells a reviewer where the blast radius of a missing authorization check is largest.
Constants
The shared safe set (QUERY included per RFC 10008): a weak privilege param on a read stays below the tag threshold, exactly as on a GET.
Path segments that strongly imply an administrative surface. Matched
as whole path segments (after splitting on /, -, _, .) so
/admin/users matches but /badminton does not. /wp-admin and
/super-admin are covered too: the split yields an admin token.
superadmin (no separator) is listed explicitly since the split
can't recover it.
Parameter names that imply a privilege/role grant regardless of the
route or method, e.g. a generic /users/{id} PATCH that accepts
is_admin. These are specific enough to flag on their own. Matched
separator-insensitively via normalize_param_name, so is_admin,
isAdmin, and is-admin all collapse to the same key.
Weaker, more generic privilege hints. These also appear as read-only
filters (GET /roles?privilege=x, ?as_user=... view switching), so
only flag them on a state-changing (non-read) method.