CD-SEC-07 - Security Misconfiguration
AI coding assistants don't volunteer security best practices, leading to functional but insecure defaults.
Intent & Description
'
🎯 Intent
Prevent security misconfigurations introduced by AI coding assistants and citizen development defaults.
📋 Context
AI coding assistants answer the literal prompt (“build a login form that checks a password”) and nothing more — they don’t volunteer security best practices that weren’t explicitly requested, so the default output is functional but not secure. Many citizen-development configuration choices sit at the application level, meaning the person with the least security context has the authority to set them.
💡 Solution
Implement automated scanning of generated code for hardcoded secrets and insecure defaults. Create securely pre-configured templates. Implement pre-deployment validation gates. Use tenant-level (not just app-level) change management for configuration. Apply security-by-default platform settings.'
Real-world Use Case
Source
📌 TL;DR
Prevent security misconfigurations. Scan generated code, use secure templates, implement validation gates, and apply tenant-level configuration controls.
Advantages
- Prevents insecure defaults
- Enables automated security checks
- Promotes secure configurations
- Reduces configuration drift
Disadvantages
- Scanning overhead
- Template maintenance
- May require platform changes