Security Misconfiguration
Wrong security settings, defaults left unchanged, or risky features enabled without a reason.
What is Security Misconfiguration?
This category is not about a bug in the code but about wrong settings. It includes unchanged default accounts, overly detailed error messages, exposed sensitive files, needlessly open ports, missing security headers, and overly permissive cloud permissions. Three of the most common forms are available to try in the demo tabs.
Default credentials: a key left behind
Many devices and apps ship with default accounts like admin/admin. These credentials are listed in public manuals, so an attacker doesn't need to guess. Always change or remove default accounts before a system goes live, and require a first-time password change.
Verbose errors & exposed files
Error messages that show a full stack trace leak the database structure, queries, and software version, all a valuable map for an attacker. Likewise, files like .env or .git accidentally served in a public folder can hand over secret keys. Show users only a generic message, and make sure sensitive files can never be accessed.
How to prevent it
Build a secure-by-default install process (hardening), keep configuration consistent across environments through automation, turn off unused features, and review settings regularly. Simplicity helps: the less that's enabled, the less there is to misconfigure.