What problem does it solve? Applications often ship with fail-open defaults—hardcoded secrets, fallback credentials, disabled authentication, or permissive CORS—that let them run insecurely in production when configuration is missing. This Skill finds those vulnerabilities before attackers do. ## Core Features & Use Cases - Fail-Open Detection: Identifies fallback secrets, hardcoded credentials, weak crypto (MD5/SHA1/DES/ECB), permissive access defaults, and debug features enabled by default. - Fail-Safe Distinction: Traces code paths to distinguish exploitable defaults from fail-secure patterns that crash safely when configuration is missing. - Production Impact Verification: Confirms whether findings actually reach production by checking deployment configs, Dockerfiles, and environment variable handling. - Use Case: During a pre-deployment security audit, run this Skill to scan src/auth/, config files, and IaC templates, producing evidence-backed findings like a hardcoded JWT secret fallback with its exploitation path. ## Quick Start Audit this repository for insecure defaults such as hardcoded secrets, fallback credentials, and fail-open security settings, and report each finding with its production impact.
