Tested fixes for the weaknesses A02:2025 maps, in Express, Flask, Spring Boot, ASP.NET Core, Rails and Laravel: the vulnerable code, the fix, a wrong fix and the regression tests.
Configuration now controls much of an application’s behavior, from cloud permissions to framework defaults, and one exposed console, default account or verbose error can undo careful code. The category moved up to second place in 2025.
- Use a repeatable, automated hardening process so that development, test and production are configured the same way, with different credentials.
- Start from a minimal platform: remove unused features, components, sample applications and default accounts.
- Send security headers and cookie attributes deliberately, and intercept detailed error messages centrally.
- Prefer short-lived credentials and platform roles to static keys, and check deployed cloud configuration for drift.
Guides on this site
Configure CORS and CSP around the browser capabilities you need
Control who can read API responses and which resources a page may execute without confusing either control with authorization.
Run Kubernetes workloads with only the privileges they need
Review pod settings, service accounts and effective permissions together before treating a namespace as an isolation boundary.
Prove network and admission policies enforce the intended boundary
Verify allowed traffic and rejected deployments in the cluster instead of treating policy files as evidence of isolation.
Review cloud permissions and role trust together
Distinguish who can obtain a cloud identity from what that identity can do, then test the effective access path.
Review infrastructure changes as access changes
Inspect the effective permissions, exposure, sensitive state, and recovery implications of a proposed infrastructure change.
Test infrastructure policy and detect security-relevant drift
Connect source configuration, the proposed plan and deployed resources so a safe review does not become stale after deployment.
Configure HTTP security headers from a tested baseline
Send the response headers that make browsers enforce HTTPS, run only your own scripts, refuse hostile framing and keep cookies on one host, then prove they appear on every kind of response.
Apply a security baseline across AWS, Azure and Google Cloud
Give workloads platform identities instead of keys, guard the instance metadata endpoint, block public storage, keep audit logs past the default retention, close inbound admin ports and use the native secret store, with tested Terraform for AWS, Azure and Google Cloud.
Ship without debug modes, verbose errors or exposed files
Turn off debug output, publish an allowlisted build and probe each deployment for exposed files and endpoints.
Preserve framework security controls across the request lifecycle
Trace middleware, persistence and rendering so custom code does not bypass the protections supplied by the framework.
Keep untrusted values out of executable syntax
Choose a safe interface for each interpreter and bound the work performed by parsers and converters.
Parse bounded JSON and XML into an explicit application schema
Separate parser capabilities from schema rules, reject ambiguous and coercible inputs, and implement the boundary in a complete Python project.
Prevent shared-cache poisoning and private-response deception
Define lookup and storage policy, trace cache/origin interpretation differences and verify both public reuse and private isolation.
Harden container images from Dockerfile to admission
Build minimal, non-root images pinned by digest, keep secrets out of every layer, then scan, sign and verify the exact digest before it runs with dropped privileges.
Prevent subdomain takeover from dangling DNS records
A DNS record that outlives its cloud resource lets whoever claims the name serve content on your domain. Bind records to resources in IaC, remove the record first, verify domains and scan for dangling records.
Practice
- Privileged container lab: Reject a privileged workload before deployment · Browser lab
- CORS policy lab: Grant CORS to the right origins only · Browser lab
- CSP builder lab: Build a strict Content-Security-Policy · Browser lab
- SQL injection lab: Separate SQL structure from data with sqlite3 · Browser lab
- OS command injection lab: Run git without a shell · Browser lab
- NetworkPolicy lab: Lock down a shop namespace · Browser lab
- SSTI lab: Render a welcome banner without template injection · Browser lab
- XXE lab: Parse an uploaded invoice without resolving external entities · Browser lab
- Pickle deserialization lab: Load a session token without pickle · Browser lab
- IAM trust policy lab: Evaluate a role trust policy against the confused deputy · Browser lab
- Secure a real HTTP API · Local project
- Repair a real proxy and shared cache · Local project
- Verify Kubernetes admission and network boundaries · Local project
- Parse bounded JSON and XML invoices safely · Local project
- Repair a native parser using sanitizer evidence · Local project
- Repair a security pipeline for GitHub Actions and GitLab CI · Local project
- Gate an image build on a CIS scan and a deviation register · Local project
References
List data from the publisher. A guide is listed as the main subject when the weakness or risk is what the guide is about, and as covering it when a dedicated section or worked example addresses it.