Security misconfiguration
OWASP Top 10:2025 ranks security misconfiguration at A02: defaults, exposed surfaces, and features left on. A check that fails open when a dependency errors is A10, mishandling of exceptional conditions, and SSRF now sits under broken access control rather than in that old slot.
Skill
No skill is linked for this class yet. Start with the playbook and the checklist on this page.
Checklists
None linked for this class yet.
Disclosures
No public card yet.
Playbooks
- Feature flags and hidden routes - A hidden button is not an authorization boundary. If the API still serves the route, the flag only hid the link.
Questions
Is a missing header a misconfig finding?
A02 is real, and it is usually context. Report it when the default exposes data, an admin surface, or a verifier that is off. A header missing on a static page is often not paid.
The service errors and the feature stays on. Which category?
That fail-open is mishandling of exceptional conditions, A10 in the 2025 list. Do not call it SSRF. SSRF now sits under broken access control. Name the exception and the state change on an account you own.
This page is the linked pack hunt_brief("misconfig") returns on the MCP connector. Authorized testing only.