# CD-SEC-07 - Security Misconfiguration

> AI coding assistants don't volunteer security best practices, leading to functional but insecure defaults.

- **Category**: Owasp Citizen Development
- **Subcategory**: top10
- **Canonical URL**: https://designpattern.fyi/patterns/cdsec07_security_misconfiguration/

---

## Description
'**Intent**: Prevent security misconfigurations introduced by AI coding assistants and citizen development defaults.

**Context**: AI coding assistants answer the literal prompt ("build a login form that checks a password") and nothing more — they don't volunteer security best practices that weren't explicitly requested, so the default output is functional but not secure. Many citizen-development configuration choices sit at the application level, meaning the person with the least security context has the authority to set them.

**Solution**: Implement automated scanning of generated code for hardcoded secrets and insecure defaults. Create securely pre-configured templates. Implement pre-deployment validation gates. Use tenant-level (not just app-level) change management for configuration. Apply security-by-default platform settings.'



## Use Cases
Use when using AI coding assistants or configuring low-code/no-code platforms where defaults may be insecure.





## Trade-offs


### Advantages

- Prevents insecure defaults

- Enables automated security checks

- Promotes secure configurations

- Reduces configuration drift




### Considerations & Drawbacks

- Scanning overhead

- Template maintenance

- May require platform changes







---
**Reference**: [Original Source](https://owasp.org/www-project-citizen-development-top10-security-risks/)