security-misconfiguration

Security Misconfiguration (OWASP A02:2025)

Security Misconfiguration leapt from #5 to #2 in the OWASP Top 10:2025, found in 3.00% of applications with over 719,000 occurrences. It occurs when systems are incorrectly configured from a security perspective — and in Python web apps, the attack surface is wide.

---

Workflow

1. Identify the framework — Flask, FastAPI, or both
2. Run static checks — Bandit SAST scan (see Tooling section)
3. Walk the checklist — go through each category below, flag issues
4. Generate a report — list findings with CWE IDs, severity, and remediation snippets
5. Verify fixes — re-run Bandit + dynamic header scan after remediation

For deep dives into any single category, read:

• references/flask-hardening.md — Flask-specific settings and extensions
• references/fastapi-hardening.md — FastAPI-specific settings and middleware
• references/security-headers.md — Full header reference with CSP examples

---

Checklist by Category

1. Debug Mode Exposed (Critical)

Flask

# BAD — never in production
app.run(debug=True)
app = Flask(__name__, debug=True)

# BAD — environment variable
# FLASK_DEBUG=1

# GOOD
app.run(debug=False)
# or: rely on FLASK_ENV=production (Flask 2.x) / FLASK_DEBUG=0

• Werkzeug's interactive debugger allows arbitrary code execution via PIN bypass
• Bandit rule: B201 (flask_debug_true)

FastAPI — has no debug mode equivalent but /docs and /redoc exposure is analogous (see §3)

---

2. Hardcoded Secrets (Critical)

Detect patterns:

# BAD
SECRET_KEY = "supersecretkey123"
DATABASE_URL = "postgresql://user:password@host/db"
JWT_SECRET = "my-jwt-secret"
AWS_SECRET_ACCESS_KEY = "wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY"

Correct approach:

import os
SECRET_KEY = os.environ["SECRET_KEY"]          # raises if missing — intentional
DATABASE_URL = os.environ.get("DATABASE_URL")  # or use python-dotenv / pydantic-settings

• Bandit rule: B105, B106, B107 (hardcoded_password_*)
• Also flag: secrets committed to .env files checked into version control
• Key CWEs: CWE-526 (Sensitive Info in Env Vars), CWE-321 (Hard-coded Crypto Key)