insecure-defaults

Insecure default configurations include weak crypto usage, hardcoded or default credentials, fail-open error handling patterns, unsafe framework defaults, and insecure TLS/SSL settings that introduce security risks across a codebase.

This skill identifies insecure defaults across source code in multiple languages. It applies during code reviews or pre-deploy checks to catch weak crypto, default credentials, and insecure framework settings before they reach production.

You do not need semgrep to detect insecure TLS and SSL settings, as the skill requires only grep and standard shell utilities. However, optional semgrep integration is available to improve detection accuracy.

This skill serves as an automated pre-deploy check for static code analysis, detecting insecure defaults across multiple risk categories. It identifies weak crypto usage, hardcoded credentials, and insecure TLS/SSL settings before deployment.

Common insecure default configurations include weak crypto usage, hardcoded or default credentials, fail-open error handling patterns, unsafe framework defaults, and insecure TLS/SSL settings that introduce security risks across a codebase.

Yes, you can use grep and standard shell utilities to find hardcoded credentials, as these are the required tools for the scanner. Optional semgrep integration can be added to improve the accuracy of the static scan.