insecure-defaults

Detects fail-open security vulnerabilities where applications run insecurely with missing or weak default configuration. Finds fail-open vulnerabilities where apps run insecurely with missing configuration. Distinguishes exploitable defaults from fail-secure patterns that crash safely. Do not use this skill for: When in doubt: trace the code path to determine if the app runs with the default or crashes. Follow this workflow for every potential finding: Determine language, framework, and project conventions. Use this information to further discover things like secret storage locations, secret usage patterns, credentialed third-party integrations, cryptography, and any other relevant configuration. Further use information to analyze insecure default configurations. Example Search for patterns in **/config/ , **/auth/ , **/database/ , and env files: Tailor search approach based on discovery results.