insecure-defaults

What problem does it solve?

This Skill helps security teams and developers identify fail-open defaults that allow applications to run insecurely in production, such as missing environment variables, weak defaults, or permissive security settings.

Core Features & Use Cases

• Insecure-default detection across config, env handling, deployment templates, and IaC.
• Differentiates fail-open from fail-secure patterns to prioritize remediation.
• Use cases include security audits, configuration reviews, and pre-deployment checks.

Quick Start

Run a targeted scan of repository configurations to identify common fail-open patterns such as SECRET = env.get('KEY') or 'default', missing required env vars, and permissive CORS settings.