## Security Misconfiguration (Medium)

### Trigger Signals

- CORS configured as `*` or allowing arbitrary Origin (`Access-Control-Allow-Origin: *`)
- Missing security response header configuration (`X-Frame-Options`, `Content-Security-Policy`, `Strict-Transport-Security`)
- Sensitive endpoints without rate limiting or with overly permissive rate limiting
- Debug mode hardcoded as enabled in code (`debug = True`, `NODE_ENV !== 'production'`)

### Key Check Points

| Configuration Type | Check Points |
|---------|--------|
| CORS | Whether `Access-Control-Allow-Origin` is `*` or dynamically reflects without whitelist validation |
| Security Response Headers | Missing `X-Frame-Options`, `X-Content-Type-Options`, `CSP`, `HSTS` |
| Rate Limiting | Whether login endpoints, SMS endpoints, payment endpoints have rate limits |
| Debug Mode | `debug=True`/`app.debug = True`/`showDetailedErrors = true` in production code |
| Cookie Security | Missing `HttpOnly`/`Secure`/`SameSite` flags |
| HTTP Methods | Unnecessary HTTP methods not disabled (DELETE, PUT, TRACE) |

### Judgment Process

1. **Check CORS configuration**: `Grep` searches for `cors`, `Access-Control-Allow-Origin`, `Read` confirms:
   - Whether it is `*` (allows any domain cross-origin access)
   - Whether it dynamically reflects `req.headers.origin` without whitelist validation
   - Whether it allows credentials (`Access-Control-Allow-Credentials: true`) with Origin as `*` (not allowed simultaneously)
2. **Check security response headers**: `Read` confirms whether the following security headers are configured:
   - `X-Frame-Options: DENY|SAMEORIGIN` (prevents clickjacking)
   - `X-Content-Type-Options: nosniff` (prevents MIME sniffing)
   - `Content-Security-Policy` (restricts resource loading sources)
   - `Strict-Transport-Security` (forces HTTPS)
3. **Check rate limiting configuration**: `Grep` searches for `rateLimit`, `throttle`, `limiter`, `Read` confirms whether sensitive endpoints have reasonable rate limiting:
   - Login endpoints (prevent brute force)
   - SMS/email endpoints (prevent spamming)
   - Payment/order endpoints (prevent order flooding)
4. **Check debug mode**: `Read` confirms whether debug mode is hardcoded as enabled in non-test files

### Evidence Construction

After confirming a defect, the output must include:
- Configuration location (CORS/security headers/rate limiting/debug mode configuration, with file:line number)
- Current configuration value (e.g., `Origin: *`, no HSTS)
- Recommended security configuration (whitelist domains, security header list, reasonable rate limit thresholds)
- Business impact (cross-origin attacks, clickjacking, brute force, information leakage)

### Exclusions

- Development environment-only configuration (`config.dev.js`/`application-dev.yml`)
- Already using security middleware like Helmet/secure-headers (automatically adds security headers)
- API gateway layer already handles rate limiting and security headers uniformly
- Internal service-to-service calls (no browser-side cross-origin risk)
