In May 2021, a security researcher at UpGuard found that OData feeds on Microsoft Power Apps portals were returning sensitive data — including PII — to anyone who queried them. No authentication required. 38 million records across 47 organisations, including American Airlines, Ford, J.B. Hunt, state COVID-19 vaccination databases, and Microsoft's own payroll system. The data included Social Security numbers, vaccination appointments, employee IDs, and millions of email addresses. Nobody had attacked anything — the data was simply public by default.
The question: Microsoft said this was "by design." The documentation warned about it. Forty-seven organisations still got it wrong. What kind of security failure is this?
Power Apps portal YAML configuration. One setting controls whether anonymous users can access table data. Click the line that opens the door.
The fix isn't complex code. It's a configuration change — and an automated check to make sure it stays changed. IaC should be treated like application code: linted, scanned, reviewed.
Every new resource starts closed. Scan config in CI — tfsec, Checkov — and fail the build before misconfiguration reaches production.
A cloud storage bucket is created by a Terraform pipeline copied from staging. The ACL defaults to public-read. What's the first line of defence?
An application returns a full stack trace with internal file paths and database connection strings when an unhandled exception occurs. What A02 sub-category is this?
In the 2025 OWASP Top 10, Security Misconfiguration moved from #5 to #2. What does OWASP cite as the primary driver?
Security is not a feature you add. It's a default you start with and verify continuously. If the safe state requires someone to remember to change a setting — that setting will be wrong in production.
A02 · Security Misconfigurationtfsec, Checkov, cfn-linttfsec or Checkov in CI and fail the build on high-severity findings. This catches public buckets, default credentials, debug mode, and missing encryption before deployment — not after a breach.Five things you can verify right now. None take more than ten minutes.