# Insecure Defaults Finder

> Systematically identify weak configurations, hardcoded secrets, insecure defaults, and misconfigured security controls across a codebase.

- Skill: `ultroncore/insecure-defaults-finder` (Agent Skill, multi-file: 5 files)
- Install (CLI): `npx skillmds@latest add ultroncore/insecure-defaults-finder`
- Raw SKILL.md: https://api.skillmd.com/api/skills/ultroncore/insecure-defaults-finder/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Security
- Author: UltronCore (https://skillmd.com/u/ultroncore)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/ultroncore/insecure-defaults-finder

---


# Insecure Defaults Finder

## Overview
Systematically identify weak configurations, hardcoded secrets, insecure default settings, and misconfigured security controls across a codebase and its infrastructure configuration.

## Trigger
Use when asked to find hardcoded secrets, check for insecure defaults, audit configuration security, detect weak cryptographic settings, or scan for credentials in code.

## Workflow

### 1. Secret and Credential Scanning
Search for hardcoded secrets using pattern matching:
```bash
# Use truffleHog or gitleaks
trufflehog filesystem <path> --json
gitleaks detect --source=<path> --report-format json

# Manual grep patterns
grep -rn "password\s*=\s*['\"]" .
grep -rn "api_key\s*=\s*['\"]" .
grep -rn "secret\s*=\s*['\"]" .
grep -rn "BEGIN.*PRIVATE KEY" .
grep -rn "AKIA[0-9A-Z]{16}" .  # AWS access keys
```

Common secret patterns to check:
- Passwords and API keys in source code
- Private keys and certificates checked into git
- Database connection strings with credentials
- OAuth tokens and service account keys
- JWT secrets and signing keys

### 2. Weak Cryptographic Defaults
- MD5 or SHA1 used for security-sensitive hashing
- ECB mode in block cipher usage
- Hard-coded IVs or salts
- Insufficient key lengths (< 2048-bit RSA, < 128-bit AES)
- `Math.random()` used for security purposes instead of CSPRNG
- Insecure TLS versions (TLS 1.0, 1.1) enabled

### 3. Authentication and Session Defaults
- Default or weak admin credentials
- Missing password complexity enforcement
- No account lockout or rate limiting
- Session tokens with insufficient entropy
- Missing `Secure` or `HttpOnly` cookie flags
- Sessions without expiration

### 4. Network and Server Configuration
Check for:
- Listening on `0.0.0.0` instead of specific interfaces
- Debug mode enabled in production configs
- CORS set to `*` (allow all origins)
- Missing HTTPS enforcement / HSTS headers
- Open ports and services not needed
- Default ports for admin interfaces

### 5. Framework and Library Defaults
Common insecure framework defaults:
- Django: `DEBUG=True`, default `SECRET_KEY`
- Express: Missing Helmet.js security headers
- Spring: Actuator endpoints exposed without auth
- Rails: `config.force_ssl = false`
- Flask: `TESTING=True` in production

### 6. Infrastructure as Code (IaC)
Scan Terraform, CloudFormation, Kubernetes manifests:
```bash
# Checkov for IaC scanning
checkov -d <path> --output json

# tfsec for Terraform
tfsec <terraform-dir> --format json
```

Flag:
- S3 buckets with public access
- Security groups with 0.0.0.0/0 ingress on sensitive ports
- Unencrypted storage (EBS, RDS, S3)
- IAM roles with `*` permissions
- Kubernetes pods running as root

### 7. Environment Variable Patterns
- Secrets passed as env vars without encryption at rest
- `.env` files committed to version control
- Missing `.gitignore` entries for config files

## Output
Report organized by category:
- **Critical**: Hardcoded credentials, exposed private keys
- **High**: Weak crypto, disabled security features
- **Medium**: Insecure defaults, missing hardening
- **Low**: Informational findings, best practice deviations

Each finding includes: location, evidence snippet (redacted), severity, and specific remediation steps.

## Related Skills
- `c-security-review` — C/C++ security
- `static-code-analysis` — static analysis
- `security-hardening-checklist` — security checklist

## GitNexus Index
This skill is indexed by GitNexus for knowledge graph traversal.
Index path: /Users/localuser/.claude/skills/insecure-defaults-finder/.gitnexus
Last indexed: 2026-05-23