A05 — Security Misconfiguration

By the end of this lesson you can:

• Recognise the common misconfigurations: defaults, debug, exposure, verbose errors.
• Explain why debug=True in production is a critical vulnerability.
• Apply a hardening checklist and the "secure by default" principle.
• Audit an app/deployment for misconfiguration with a checklist tool.

Many breaches need no exploit at all — just a door someone forgot to lock: a database with no password exposed to the internet, an admin panel at /admin with admin/admin, a debug page leaking the source code and secrets, a cloud bucket set to "public." Boring. Devastating. Extremely common.

⚠️ Debug mode in production — a critical one

# DANGEROUS in production:
app.run(debug=True)        # Flask: exposes the Werkzeug debugger

The misconfiguration catalogue

MISCONFIGURATION                       FIX
debug mode on in prod                  debug=False; config via env
default credentials (admin/admin)      force a strong password on setup
exposed services (DB on 0.0.0.0)       bind to localhost / firewall (L8-03,20)
verbose error pages (stack traces)     generic error pages; log details server-side
directory listing enabled             disable it; don't serve source/configs
unused features/ports/accounts open    remove them (minimise attack surface, L8-02)
permissive CORS (Access-Control-* *)   allow-list specific origins
missing security headers              HSTS, CSP, X-Frame-Options, X-Content-Type
public cloud buckets / open .git       lock down storage; block /.git, /.env

Verbose errors leak the map

# BAD: a stack trace shown to users reveals file paths, library versions,
#      SQL queries, and sometimes secrets — a recon goldmine for attackers.

# GOOD: generic message to the user, full detail to the server log.
@app.errorhandler(500)
def server_error(e):
    log.exception("unhandled error")          # detail → server log (L8-45)
    return "Something went wrong.", 500        # generic → the user

Secure by default + a deploy checklist

import os
# config from the environment; SECURE defaults baked in:
DEBUG = os.getenv("FLASK_DEBUG", "false").lower() == "true"   # default OFF
SECRET_KEY = os.environ["SECRET_KEY"]          # required, from env (no default!)

app.config.update(
    DEBUG=DEBUG,
    SESSION_COOKIE_HTTPONLY=True,
    SESSION_COOKIE_SECURE=True,
    SESSION_COOKIE_SAMESITE="Lax",
)

"Secure by default" means the safe setting is the one you get if you do nothing: debug off, cookies hardened, secrets required (not defaulted). Pair it with a written hardening checklist run before every deploy.

Goal: a tool that checks a Flask app/config for common misconfigurations and reports a hardening score — the kind of pre-deploy gate that catches the boring-but-fatal mistakes.

import os, re
from pathlib import Path

def audit_flask_app(source_path: str, env: dict) -> list[str]:
    findings = []
    src = Path(source_path).read_text(encoding="utf-8")

    # 1. debug mode
    if re.search(r"debug\s*=\s*True", src):
        findings.append("🔴 CRITICAL: debug=True found — RCE risk in prod. "
                        "Set debug=False / control via env.")
    # 2. hard-coded secret key
    if re.search(r"secret_key\s*=\s*['\"][^'\"]+['\"]", src, re.I):
        findings.append("🔴 hard-coded SECRET_KEY — load from env.")
    # 3. binding to all interfaces
    if re.search(r"host\s*=\s*['\"]0\.0\.0\.0['\"]", src):
        findings.append("🟡 binds 0.0.0.0 — ensure a firewall; localhost in dev.")
    # 4. cookie hardening missing
    if "SESSION_COOKIE_HTTPONLY" not in src:
        findings.append("🟡 session cookies not hardened — set HttpOnly/Secure/SameSite.")
    # 5. env-based runtime checks
    if env.get("FLASK_DEBUG", "false").lower() == "true":
        findings.append("🔴 FLASK_DEBUG=true in this environment.")
    if not env.get("SECRET_KEY"):
        findings.append("🟡 SECRET_KEY not set in the environment.")
    return findings

issues = audit_flask_app("app.py", dict(os.environ))
print(f"Hardening audit — {len(issues)} issue(s):\n")
for i in issues:
    print(" ", i)
print("\n✅ secure-by-default" if not issues else "\nfix the above before deploying.")

Hardening audit — 3 issue(s):

  🔴 CRITICAL: debug=True found — RCE risk in prod. Set debug=False / control via env.
  🔴 hard-coded SECRET_KEY — load from env.
  🟡 session cookies not hardened — set HttpOnly/Secure/SameSite.

fix the above before deploying.

Read the code

The audit encodes the misconfiguration catalogue as concrete checks, ranked by severity — and the standout is debug=True flagged CRITICAL, because in production it's effectively remote code execution, not a minor setting. Run this as a pre-deploy gate (or in CI, Level 7) and the boring-but-devastating mistakes get caught before they ship. Combine it with the Lesson 20 port self-scan (is the DB exposed?) and Lesson 6 footprint check (is /.git or a debug page reachable?) for full-stack coverage.

Security Misconfiguration (A05) is the gap between "works" and "safe" — and it's the most preventable category. The usual suspects: debug mode in production (effectively RCE via Flask's console — always off), default credentials, exposed services (bind localhost/firewall), verbose error pages (generic to users, detail to logs), and missing security headers. The fix is discipline, not cleverness: secure by default (safe settings unless you opt out), minimise attack surface, and run a hardening checklist across the whole stack every deploy. Combine config audits, port self-scans, and exposed-path checks for full coverage.