insecure-defaults

To detect insecure default configurations, the Skill searches for fail-open vulnerabilities, disabled security features, and weak cryptography. It validates these findings by tracing code paths to confirm whether the application runs insecurely in production when settings are missing.

Fail-open vulnerabilities are insecure default configurations that allow an application to run insecurely when a proper setting is missing. The Skill pinpoints these patterns, distinguishing them from fail-secure configurations that cause a safe crash.

Yes, you can audit environment variable handling for weak authentication settings. The Skill reviews configuration management to find instances where API keys or database passwords have insecure fallback values exposed if environment variables are not set.

Code review for secrets management identifies exposed debug modes by analyzing code for permissive security settings and disabled security features. It validates findings by tracing code paths to confirm the actual runtime behavior and production impact.

Yes, the configuration audit works with Python and JavaScript files. It scans the current directory to detect weak cryptography, hardcoded secrets, and insecure defaults, tracing code paths to validate runtime behavior across these languages.