What problem does it solve? Applications often ship with fail-open defaults—hardcoded secret fallbacks, disabled authentication, permissive CORS, or weak cryptography—that silently run insecurely in production when configuration is missing. This Skill systematically finds these vulnerabilities and distinguishes them from safe fail-secure patterns. ## Core Features & Use Cases - Fail-Open Detection: Identifies fallback secrets, default credentials, disabled auth, weak crypto (MD5/SHA1/DES/ECB), permissive access controls, and exposed debug features across Python, JavaScript, Ruby, and Java codebases. - Verification Workflow: Traces code paths to confirm runtime behavior and production impact before reporting, filtering out test fixtures, example files, and fail-secure crash-on-missing patterns. - Evidence-Based Reporting: Produces structured findings with location, pattern, verification steps, production impact, and exploitation scenarios. - Use Case: Before deploying a web service, run an audit to catch patterns like SECRET = env.get('KEY') or 'default' that would let attackers forge JWTs if the environment variable is missing in production. ## Quick Start Audit this repository for insecure defaults such as hardcoded secret fallbacks, disabled authentication, and weak cryptography, and report each finding with production impact evidence.
