Check AI-generated configuration for default accounts and passwords, detailed error output, missing security headers, unused features left switched on, and storage open to everyone. These are the misconfiguration examples OWASP lists, and a sample-style config from an assistant can contain any of them, because examples are written to run, not to be hardened.
Why config is the quiet risk
Generated application code gets most of the attention. Configuration files, container definitions and infrastructure templates get less, yet OWASP's Security Misconfiguration page describes problems that live exactly there: sample applications left on a production server with an admin console and unchanged default accounts, stack traces returned to users, and cloud storage shared openly.
An assistant asked for a quick setup will often optimise for getting something running. A permissive setting makes the demo work.
A review list
| Area | Look for | OWASP guidance |
|---|---|---|
| Accounts | Default usernames and passwords, sample admin consoles | Remove sample apps and change defaults |
| Errors | Debug mode, stack traces in responses | Do not expose detailed errors to users |
| Features | Unused components, docs, samples | Keep the platform minimal |
| Headers | No or weak security headers | Send security directives to clients |
| Storage | Public buckets, wide sharing | Review cloud storage permissions |
| Environments | Same credentials in dev and prod | Different credentials in each |
Steps
- Diff every config file the assistant touched, including Dockerfiles and templates, not only source files.
- Search for words that signal development mode, such as debug, sample, example, admin and wildcard origins.
- Remove anything the application does not use.
- Confirm that production credentials come from a secret store, not the file.
- Run an automated check in each environment. OWASP recommends verifying that configurations are effective, not assuming it.
- Keep a hardened baseline file and ask the assistant to start from it rather than from nothing.
Baselines beat prompts
Telling an assistant to be secure helps a little. Giving it a reviewed baseline, then diffing against it, helps more, because a deviation becomes visible. The same idea works for container files; see a starter Dockerfile with secure defaults.
Where Safeguard fits
Safeguard scans container images and web applications and can run dynamic checks against a running app, which surfaces missing headers and verbose errors. Try a free scan.
Try it yourself
Click through it at your own pace, or open it full screen.
Click through the web app scan and look at which response-level findings it reports.
Quick check
Is debug mode really a security issue?
It can expose stack traces and version details, which OWASP lists as an example of misconfiguration.
Should dev and production share credentials?
No. OWASP advises identical configuration with different credentials in each environment.
Sources
Last reviewed: 19 October 2026.
