# security-misconfiguration

> Claude/Codex skill by [@thejefflarson](https://omgskills.com/library/thejefflarson/index.md) · 20 stars · Updated 2026-07-31

Detects insecure defaults, overly permissive CORS, exposed debug endpoints, and missing security headers. Use when writing server configuration, setting environment variables, configuring CORS policies, enabling debug modes, setting up default credentials, or deploying application infrastructure. Also invoke when writing security headers middleware.

Tags: llms, security, skills

## Install

```sh
git clone https://github.com/thejefflarson/soundcheck /tmp/soundcheck && ln -s /tmp/soundcheck/.claude/skills/security-misconfiguration ~/.claude/skills/security-misconfiguration
```

## From README

Security Misconfiguration Security Check (A02:2025) What this checks Protects against insecure defaults, overly permissive policies, and missing hardening that expose the application to cross-origin attacks, credential stuffing, and information disclosure via error pages or debug endpoints. Vulnerable patterns Wildcard CORS origin combined with credentials enabled — every site on the web gets cookie-authenticated access Debug or verbose-error mode hardcoded on, exposing tracebacks, route lists, or interactive consoles in production Wildcard or empty host/origin allowlist accepted in production configuration HTTP server with no security-headers layer registered — Strict-Transport-Security, X-Content-Type-Options, and a framing/CSP control missing. For hardcoded secrets see hardcoded-secrets. Fix immediately Flag the vulnerable code, explain the risk, and suggest a fix establishing these properties.

## Links

- HTML page: https://omgskills.com/library/thejefflarson/soundcheck/dot-claude/skills/security-misconfiguration/
- GitHub: https://github.com/thejefflarson/soundcheck
- Author: [@thejefflarson](https://omgskills.com/library/thejefflarson/index.md)

## More from this repo

- [authentication-failures](https://omgskills.com/library/thejefflarson/soundcheck/dot-claude/skills/authentication-failures/index.md) — Detects weak password storage, flawed JWT validation, sessions surviving logout, and missing MFA in authentication code.
   - [@thejefflarson](https://omgskills.com/library/thejefflarson/index.md) · 20 stars
- [broken-access-control](https://omgskills.com/library/thejefflarson/soundcheck/dot-claude/skills/broken-access-control/index.md) — Detects missing ownership checks, broken role enforcement, and IDOR vulnerabilities that let users access other users'...
   - [@thejefflarson](https://omgskills.com/library/thejefflarson/index.md) · 20 stars
- [concurrency-correctness](https://omgskills.com/library/thejefflarson/soundcheck/dot-claude/skills/concurrency-correctness/index.md) — Detects multi-threaded code where a lock is held across a blocking operation, lock acquisition order risks deadlock,...
   - [@thejefflarson](https://omgskills.com/library/thejefflarson/index.md) · 20 stars