Security Misconfiguration
Default configs, verbose errors, open cloud storage, unnecessary features, and missing hardening headers.
OWASP rank: 5
Practical checks
- Scan for exposed panels, .git, backups, debug endpoints
- Check security headers and CORS config
- Look for open cloud buckets
- Review verbose error messages / stack traces