# Security checks that fail open

Prompt · Testing and security · T05

Finds security checks that let people in when something goes wrong.

## Prompt

```text
Search for security-sensitive behavior that fails open when configuration is missing, an authorization service fails, or a request is malformed.
```

**What it returns:** Each check with what happens on missing config, thrown error and malformed input, shown with a request or test.

**Skip it when:** Never skip for sign-in, keys or owner checks.

**Tools:** Repository; the app running locally in demo mode.

**Changes:** Changes nothing

**Sessions:** One session

## Related

- [Settings that differ in production](https://atlasscope.dev/prompts/settings-that-differ-in-production): Finds settings that behave differently in production than anyone expects.
- [Outside input reaching sensitive actions](https://atlasscope.dev/prompts/outside-input-reaching-sensitive-actions): Follows input from outsiders to the places it can do harm.
- [Fallbacks that look like real data](https://atlasscope.dev/prompts/fallbacks-that-look-like-real-data): Finds screens that show a confident zero or an empty list when the real answer is 'we could not load this'.

Source: https://atlasscope.dev/prompts/security-checks-that-fail-open