insecure-defaults

A fail-open security default allows applications to continue running with weak or unsafe behavior, such as using fallback secrets or permissive settings, when configuration or environment variables are missing, exposing production systems to vulnerability.

You can audit production-reachable code by searching for config, auth, and credential patterns, then tracing code paths to verify runtime behavior when environment variables are absent and confirming the actual security impact.

Yes, this audit covers common insecure defaults including permissive access settings like CORS, weak crypto usage, default credentials, and debug features that may inadvertently run in production when configuration is missing.

To distinguish fail-secure from fail-open behavior, trace the code paths of your config and auth patterns to verify the actual runtime behavior, ensuring the application safely halts or restricts access when environment variables or secrets are missing.

The best way to scan IaC and configuration is by performing discovery-focused searching for default credential patterns and debug features, then tracing those findings to confirm their production impact and severity.