insecure-defaults

Detects fail-open security vulnerabilities where applications run insecurely due to missing or weak configuration. Focuses on distinguishing exploitable defaults (app runs with a weak secret) from fail-secure patterns (app crashes without proper config). Covers hardcoded credentials, weak crypto, permissive access controls, and debug features left enabled. Manual code review misses fail-open patterns because the code looks correct at a glance — this skill traces the actual runtime path to confirm whether a missing env var causes a crash or silently falls back to a weak default.