insecure-defaults

A fail-open security misconfiguration occurs when missing environment variables trigger weak secrets, disabled security checks, or permissive access. This Skill detects insecure defaults where missing configuration leads to vulnerable behavior instead of safe crash-on-missing failure.

To scan for insecure default environment variable fallbacks, use this Skill to search production-reachable paths for secret fallbacks and weak security flags. It verifies code paths and produces a prioritized report with file locations and verification notes.

Yes, this detects hardcoded secret fallbacks across authentication, crypto, CORS/permissions, debug features, and environment-variable handling. It distinguishes vulnerable defaulting behavior from safe fail-secure crash-on-missing patterns.

To distinguish fail-secure behavior from exploitable defaulting, this Skill applies discovery-guided searching and code-path verification. It produces evidence-rich reporting that separates safe crash-on-missing patterns from insecure defaults.

Yes, you can use this for a production API security audit. It traces runtime behavior of environment-variable fallbacks like default SECRET_KEY values to confirm whether production configuration safely overrides insecure defaults.

The best way to triage production impact is using this Skill's guided verification and evidence gathering. It confirms whether missing or default production configuration makes a finding critical due to fail-open behavior.