insecure-defaults

Security audits for insecure defaults detect fail-open configurations by analyzing code patterns that mishandle environment variables. They uncover hardcoded credentials and weak settings that cause production systems to run insecurely when defaults are used.

Insecure defaults detection is suitable for security audits, configuration governance, and IaC reviews across applications. It analyzes configuration management and deployment templates to identify hardcoded credentials and permissive security settings.

You can detect fail-open behavior by scanning for code patterns that mishandle configuration and environment variables. This identifies when applications yield insecure behavior due to missing environment variables or reliance on weak default settings.

The output is a structured report containing actionable mitigations for detected insecure defaults. It highlights hardcoded credentials, weak authentication, and permissive permissions discovered during the code and configuration pattern analysis.

The primary limitation is that it relies on analyzing code patterns and static configuration management. It may not detect complex runtime security vulnerabilities or dynamic secrets injected into production environments outside the codebase.