Security Misconfiguration Skill

Security misconfiguration is the gap between a framework's default settings (permissive, developer-friendly) and what a production system should allow (restrictive, hardened). An agent generating server config or cloud resources starts from defaults. Defaults are not production-ready.

What to Check Before Writing Configuration Code

1. Debug mode and error verbosity Debug mode must be off in production. Detailed error messages (stack traces, SQL queries, environment variables) must not be returned to clients. Check: DEBUG=True, ENV=development, verbose error handlers, framework-level debug flags.

2. Default credentials Default usernames and passwords on databases, admin panels, and services must be changed before deployment. Flag any infrastructure code that deploys a service without explicitly setting credentials.

3. CORS policy Access-Control-Allow-Origin: * is a block condition for any endpoint that handles authenticated requests or sensitive data. CORS must specify exact allowed origins.