insecure-defaults

# Insecure Defaults Detection Systematic detection of security misconfigurations where the default behavior is insecure. These are the bugs that ship because "it worked in development." ## Detection Categories ### 1. Fail-Open Configurations Code that defaults to allowing access when a security check fails. ```typescript // BAD: Fail-open -- if auth service is down, everyone gets in async function checkAuth(token: string): Promise<boolean> { try { return await authService.verify(token) } catch { return true // INSECURE: fails open } } // GOOD: Fail-closed -- if auth service is down, deny access async function checkAuth(token: string): Promise<boolean> { try { return await authService.verify(token) } catch { return false // SECURE: fails closed } } ``` **Detection pattern**: Look for `catch` blocks that return truthy/permissive values in auth/authz code. ### 2. Hardcoded Secrets ```typescript // BAD patterns -- detect ALL of these const API_KEY = "sk-proj-abc123" const DB_PASSWORD = "admin123" const JWT_SECRET = "super-secret-key" const ENCRYPTION_KEY = Buffer.from("0123456789abcdef") // GOOD const API_KEY = process.env.API_KEY if (!API_KEY) throw new Error('API_KEY environment variable required') ``` **Detection patterns**: - String literals assigned to variables named `*key*`, `*secret*`, `*password*`, `*token*`, `*credential*` - Base64-encoded strings in source (potential embedded keys) - `Bearer ` followed by a string literal - AWS ...