What problem does it solve? Applications often ship with fail-open defaults—hardcoded secret fallbacks, disabled authentication, permissive CORS, or weak cryptography—that silently run insecurely in production when environment variables are missing. This Skill finds those vulnerabilities and distinguishes them from safe fail-secure patterns. ## Core Features & Use Cases - Fail-Open Detection: Identifies fallback secrets, default credentials, disabled auth, weak crypto (MD5/SHA1/DES/ECB), permissive access, and debug features enabled by default. - Verification Workflow: Traces code paths to confirm whether the app actually runs with the insecure default or crashes safely, reducing false positives. - Scoped Analysis: Skips test fixtures, example files, and documentation to focus on production-reachable code. - Use Case: During a pre-deployment security audit, scan a Node.js codebase and find that process.env.JWT_SECRET || 'default' lets the app start with a known secret, allowing attackers to forge tokens. ## Quick Start Audit this repository for insecure defaults such as hardcoded secret fallbacks, disabled authentication, and weak cryptography, and report each finding with its production impact.
