insecure-defaults

Insecure defaults are fail-open configurations where applications start with weak secrets, hardcoded credentials, or permissive authentication, allowing them to run insecurely in production rather than crashing safely. They pose significant risk when default environment variable handling is permissive.

Audit environment variables by reviewing runtime code and configuration templates to surface insecure environment handling and risky env usage. Validate whether the application fails open with weak defaults or crashes safely when variables are missing.

The best way to detect fail-open patterns is to review IaC templates for permissive auth and weak secrets, tracing the code path to assess production impact. This distinguishes safe defaults from risky ones during deployment validation.

Yes, you can apply insecure default detection across deployment templates and configuration management to guide security reviews. It surfaces hard-coded credentials and risky env usage, providing remediation guidance to fix issues before deployment.

Your application runs insecurely because fail-open defaults allow it to start with weak secrets or permissive auth rather than crashing. Insecure environment handling means the code path bypasses safe validation when variables are missing.