Security Misconfiguration (OWASP A02:2025)

Security Misconfiguration leapt from #5 to #2 in the OWASP Top 10:2025, found in 3.00% of applications with over 719,000 occurrences. It occurs when systems are incorrectly configured from a security perspective — and in Python web apps, the attack surface is wide.

Workflow

1. Identify the framework — Flask, FastAPI, or both
2. Run static checks — Bandit SAST scan (see Tooling section)
3. Walk the checklist — go through each category below, flag issues
4. Generate a report — list findings with CWE IDs, severity, and remediation snippets
5. Verify fixes — re-run Bandit + dynamic header scan after remediation