# Security Misconfiguration

admin / admin
administrator / password
root / root
admin / password123
user / user

MySQL: root / (blank)
MongoDB: admin / (blank)
PostgreSQL: postgres / postgres
Redis: (no password)

Router: admin / admin
Camera: admin / 12345
Printer: admin / (blank)
NAS: admin / password

# settings.py - DANGEROUS in production
DEBUG = True  # NEVER in production!

INSTALLED_APPS = [
    'django.contrib.admin',        # Needed
    'django.contrib.auth',         # Needed
    'myapp',                       # Needed
    'debug_toolbar',               # DEV ONLY - remove!
    'django_extensions',           # DEV ONLY - remove!
]

ALLOWED_HOSTS = ['*']  # DANGEROUS - allows any host header

# settings.py - SECURE in production
DEBUG = False  # Always False in production

INSTALLED_APPS = [
    'django.contrib.admin',
    'django.contrib.auth',
    'myapp',
    # Development tools removed
]

ALLOWED_HOSTS = ['myapp.com', 'www.myapp.com']  # Specific domains only

# elasticsearch.yml - WRONG
network.host: 0.0.0.0  # Binds to all interfaces - publicly accessible
xpack.security.enabled: false  # No authentication required

# elasticsearch.yml - CORRECT
network.host: 127.0.0.1  # Only localhost access
xpack.security.enabled: true  # Require authentication
xpack.security.authc:
  realms:
    native:
      native1:
        order: 0

# mongod.conf - WRONG
net:
  bindIp: 0.0.0.0  # Public access
  port: 27017
security:
  authorization: disabled  # No authentication

# mongod.conf - CORRECT
net:
  bindIp: 127.0.0.1  # Localhost only
  port: 27017
security:
  authorization: enabled  # Require authentication

# config.py
class ProductionConfig:
    DEBUG = False
    TESTING = False

    # Restrict allowed hosts
    ALLOWED_HOSTS = ['myapp.com', 'www.myapp.com']

    # Disable development tools
    SQLALCHEMY_ECHO = False

    # Remove debug toolbar
    DEBUG_TB_ENABLED = False

# Disable directory browsing
Options -Indexes

# Disable .htaccess override
<Directory /var/www/html>
    AllowOverride None
</Directory>

# Hide server signature
ServerTokens Prod
ServerSignature Off

# Hide version number
server_tokens off;

# Disable directory listing
autoindex off;

# Limit request methods
if ($request_method !~ ^(GET|HEAD|POST)$ ) {
    return 444;
}

from flask import Flask

app = Flask(__name__)

@app.after_request
def set_security_headers(response):
    response.headers['X-Frame-Options'] = 'DENY'
    response.headers['X-Content-Type-Options'] = 'nosniff'
    response.headers['X-XSS-Protection'] = '1; mode=block'
    response.headers['Strict-Transport-Security'] = 'max-age=31536000; includeSubDomains'
    response.headers['Content-Security-Policy'] = "default-src 'self'"
    response.headers['Referrer-Policy'] = 'strict-origin-when-cross-origin'
    return response

const express = require('express');
const helmet = require('helmet');

const app = express();

// Use helmet for security headers
app.use(helmet());

// Custom CSP
app.use(helmet.contentSecurityPolicy({
    directives: {
        defaultSrc: ["'self'"],
        scriptSrc: ["'self'", "https://trusted-cdn.com"],
        styleSrc: ["'self'", "'unsafe-inline'"],
        imgSrc: ["'self'", "data:", "https:"],
    }
}));

# Set security headers
Header always set X-Frame-Options "DENY"
Header always set X-Content-Type-Options "nosniff"
Header always set X-XSS-Protection "1; mode=block"
Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains"
Header always set Content-Security-Policy "default-src 'self'"
Header always set Referrer-Policy "strict-origin-when-cross-origin"

# Enable automatic security updates
sudo apt install unattended-upgrades
sudo dpkg-reconfigure --priority=low unattended-upgrades

# Configure automatic updates
echo 'APT::Periodic::Update-Package-Lists "1";
APT::Periodic::Unattended-Upgrade "1";
APT::Periodic::AutocleanInterval "7";' | sudo tee /etc/apt/apt.conf.d/20auto-upgrades

# Node.js - npm audit
npm audit
npm audit fix

# Python - safety check
pip install safety
safety check

# Ruby - bundler-audit
bundle audit check --update

from flask import Flask, jsonify
import logging

app = Flask(__name__)

# Configure logging
logging.basicConfig(
    filename='app.log',
    level=logging.ERROR,
    format='%(asctime)s %(levelname)s: %(message)s'
)

@app.errorhandler(Exception)
def handle_error(error):
    # Log full error details
    logging.error(f"Error: {str(error)}", exc_info=True)

    # Return generic message to user
    if app.debug:
        # Only show details in development
        return jsonify({'error': str(error)}), 500
    else:
        # Generic message in production
        return jsonify({
            'error': 'An error occurred',
            'error_id': generate_error_id()
        }), 500

app.use((err, req, res, next) => {
    // Log full error
    console.error('Error:', err);

    // Return generic message
    if (process.env.NODE_ENV === 'production') {
        res.status(500).json({
            error: 'An error occurred',
            errorId: generateErrorId()
        });
    } else {
        // Show details in development
        res.status(500).json({
            error: err.message,
            stack: err.stack
        });
    }
});