insecure-defaults

Fail-open insecure defaults occur when missing environment variables or weak fallback settings allow applications to run insecurely in production, often bypassing authentication or exposing secrets during security audits.

Scan environment variables using static-pattern detection to find insecure fallbacks like SECRET = env.get('KEY') or 'default', ensuring missing required configurations fail securely instead of exposing hardcoded secrets.

Static analysis applies to security audits of deployment templates and IaC by detecting permissive CORS settings and weak auth patterns, differentiating fail-open from fail-secure configurations to prioritize remediation.

The best way to differentiate fail-open from fail-secure patterns is applying static-pattern detection across configuration handling to prioritize remediation of weak defaults and permissive access controls that allow insecure production execution.

Insecure-defaults detection works for pre-deployment checks by scanning codebases, configuration files, and environment variable handling to identify permissive security settings and missing required variables before production release.