Risk: Improperly configured security settings. Covers default credentials, unnecessary features, and poor configuration management.
Audit configuration, enforce secure defaults, and add protective headers and baseline hardening.
Harden a sample app and verify via scanners and headers inspection.
Implement secure templates and automated checks in CI.