insecure-defaults

Detect fail-open insecure default configurations by scanning code, configuration files, and IaC templates to identify vulnerabilities like hardcoded secrets or weak authentication. This process validates actual runtime behavior to distinguish critical findings from safe defaults.

Fail-open security vulnerabilities occur when missing or weak default configurations allow applications to run insecurely in production. Hardcoded secrets and permissive settings like CORS = '*' cause this by enabling unauthorized access instead of crashing the app.

Audit Infrastructure as Code templates for weak authentication mechanisms by scanning for insecure defaults that allow applications to run insecurely. This identifies permissive security settings and validates production impact to flag critical vulnerabilities.

This security audit distinguishes test-specific configurations from production vulnerabilities by validating actual runtime behavior and production impact. It differentiates critical fail-open findings from safe defaults to prevent false positives during security reviews.

Your application defaults to allowing all cross-origin requests when environment variables are missing due to insecure default configurations. This fail-open behavior acts as a critical vulnerability by allowing potentially unauthorized access in production environments.

You can use this to find fallback secrets in your project's configuration files by scanning for insecure defaults. It detects hardcoded secrets and permissive security settings to identify vulnerabilities that allow applications to run insecurely.