sharp-edges

Security design flaws are API designs and configurations that make it easy for developers to introduce vulnerabilities. They include dangerous default settings and error-prone interfaces, often called footguns, that lead to accidental security mistakes.

You can audit configurations for dangerous defaults by analyzing configuration files and options to detect insecure settings. This process evaluates whether the default state is secure and identifies options that enable vulnerabilities or security mistakes.

To review a cryptographic library for dangerous configurations, analyze its API design to ensure it does not allow developers to easily choose weak algorithms or misuse keys. Focus on verifying secure defaults and eliminating error-prone interfaces.

Your API design allows security mistakes because it likely contains footguns and dangerous default configurations. When an interface lacks misuse-resistant principles, the easiest development path often leads to vulnerabilities and insecure implementations.

Yes, you can use this approach to audit secure defaults in any configuration. It analyzes code and configuration files broadly to detect dangerous defaults and insecure options, ensuring the easiest setup path remains secure across different libraries.

A limitation of analyzing code for security footguns is that it focuses primarily on design flaws, dangerous configurations, and API usability rather than runtime vulnerabilities or network-level exploits, targeting structural misuse-resistant principles instead.