Prompt·Testing and security·T05
Security checks that fail open
Finds security checks that let people in when something goes wrong.
Prompt
Search for security-sensitive behavior that fails open when configuration is missing, an authorization service fails, or a request is malformed.
- What it returns
- Each check with what happens on missing config, thrown error and malformed input, shown with a request or test.
- Skip it when
- Never skip for sign-in, keys or owner checks.
- Changes
- Changes nothing
- Sessions
- One session
- Tools
- Repository; the app running locally in demo mode.
- Also called
- Fail-open security paths
Related prompts
- Settings that differ in productionPromptFinds settings that behave differently in production than anyone expects.
- Outside input reaching sensitive actionsPromptFollows input from outsiders to the places it can do harm.
- Fallbacks that look like real dataPromptFinds screens that show a confident zero or an empty list when the real answer is 'we could not load this'.
More in Testing and security.