Security misconfiguration
When systems, frameworks, or cloud services are insecurely configured — default passwords left in place, unnecessary features turned on, open storage buckets, overly verbose error messages. One of the most common and most avoidable causes of breaches. Its own category in the OWASP Top 10.
Common examples: an S3 bucket set to public (a classic data leak), default passwords/accounts that were never changed, debug mode or stack traces exposed in production (leaking internal info), unnecessary ports/services/features active (a larger attack surface), missing security headers, or overly generous cloud permissions. It's not a bug in the code but in HOW things were set up. Why it's so common: defaults are often insecure for convenience, systems are complex with many knobs, and "it works" is prioritized over "it's hardened". Defense: hardened baselines/golden images, the principle of least privilege, automated configuration review (CSPM in the cloud), removing everything unnecessary, and regular review. Tightly tied to secrets-in-code and hardcoded credentials. Related to secrets-in-code and attack surface.