What problem does it solve? Applications often ship with fail-open defaults—hardcoded secret fallbacks, disabled authentication, permissive CORS, or weak cryptography—that silently run insecurely in production when configuration is missing. This Skill finds those vulnerabilities and distinguishes them from safe fail-secure patterns. ## Core Features & Use Cases - Fail-Open Detection: Identifies fallback secrets, default credentials, disabled auth, weak crypto (MD5/SHA1/DES/ECB), permissive access, and debug features enabled by default. - Verification Workflow: Traces code paths to confirm runtime behavior and production impact before reporting, filtering out test fixtures and example files. - Evidence-Based Reporting: Produces findings with location, pattern, verification, production impact, and exploitation scenario. - Use Case: During a pre-deployment security audit, scan a Node.js codebase and discover const secret = process.env.JWT_SECRET || 'default' in the auth module, confirming the Dockerfile never sets JWT_SECRET—an attacker could forge tokens. ## Quick Start Audit this repository for insecure default configurations and report any fail-open vulnerabilities with evidence of production impact.
