insecure-defaults

The 'insecure-defaults' skill identifies fail-open configurations in applications that can lead to security vulnerabilities when deployed in production. It focuses on detecting hardcoded secrets, weak authentication mechanisms, and overly permissive security settings that allow software to operate with unsafe defaults. By analyzing configuration files, environment variable handling, and code patterns, this skill helps uncover situations where missing or default settings could compromise the integrity and confidentiality of an application. It differentiates between fail-open patterns, which allow the app to run insecurely, and fail-secure patterns, which prevent execution without proper configuration.

Key capabilities of this skill include scanning for fallback secrets, hardcoded credentials, weak default flags, and outdated cryptographic algorithms in code and configuration files. It provides a structured workflow that begins with project discovery, identifying potentially insecure configurations, followed by verification of runtime behavior to understand how defaults are applied. The skill also evaluates the production impact of each finding, helping security teams prioritize critical vulnerabilities and generate detailed evidence-based reports. It emphasizes focusing on production-reachable code while ignoring test fixtures, example files, and build-time configurations that do not affect runtime security.

This skill is particularly useful for security auditors, DevOps engineers, and software developers responsible for code quality and configuration management. It supports pre-deployment checks for secrets management and security compliance, assists in reviewing IaC templates, Docker configurations, and environment variable usage, and helps ensure that applications do not ship with exploitable default settings. By providing guidance on when and how to report insecure defaults, it enables teams to proactively mitigate security risks before production release.