insecure-defaults-anti-pattern

What problem does it solve?

This Skill addresses the critical security risk of applications operating with weak or default settings when essential configuration is missing, preventing silent security bypasses.

Core Features & Use Cases

• Identify Fail-Open Vulnerabilities: Detects when applications use insecure fallback values for secrets, credentials, or security settings instead of failing securely.
• Promote Fail-Secure Practices: Guides developers to implement systems that crash or halt operations when critical configurations are absent, ensuring a secure state.
• Use Case: Reviewing a new microservice's configuration to ensure that sensitive parameters like API keys or database credentials are not using hardcoded or easily guessable default values, which could be exploited if the environment variables are accidentally omitted during deployment.

Quick Start

Review the current directory for insecure default configurations in Python code.