Enterprise Config Traps
A searchable catalogue of dangerous defaults, brittle infrastructure patterns, and production-grade configuration failures that hide in ordinary enterprise platforms.
Active Threat Records
129 RECORDSDisabling SID Filter Quarantine on a Forest Trust Reopens SIDHistory Escalation
A trust-wide fix for broken migrated access silently removes the boundary control that stops SIDHistory-based privilege escalation between forests.
Missing etcd Encryption Configuration Leaves Kubernetes Secrets Recoverable in Backups
Kubernetes Secrets decode from etcd as plain base64 unless a real encryption provider is configured on kube-apiserver - RBAC alone does not protect backups or etcd access.
ECR Scan-on-Push Leaves Old Container Images Permanently Unscanned
ECR scan-on-push only scans images pushed after the setting is enabled, leaving existing images invisibly unscanned. Here is how to find, fix and safely roll back the gap.
Orphaned NS Delegation Leaves a DNS Subdomain Open to Takeover
A stale NS delegation to a decommissioned third-party DNS zone silently enables subdomain takeover. Here is the diagnosis, correction, validation and rollback path.
Switching an Azure Key Vault to RBAC Leaves Legacy Access Policies Dormant, Not Deleted
Enabling Azure RBAC on a Key Vault does not clear its legacy access policy list. If the setting is later reverted, dormant permissions reactivate silently, bypassing every RBAC-based access removal.
An IAM Permissions Boundary Fails to Block Decrypt Access Granted by a KMS Key Policy
A permissions boundary caps what a role's own policies can grant, but it never touches what a resource-based policy, such as a KMS key policy, grants back to that role from another account.
Default NSG Inbound Rule Silently Allows Lateral Traffic Across an Entire Azure Virtual Network
An Azure NSG that looks locked down can still allow unrestricted traffic between hosts in the same virtual network, because a non-removable default rule permitting VNet-sourced traffic is never overridden by deny rules aimed only at internet ranges.
Account Root Principal in IAM Trust Policy Grants Every Identity, Not Just Root
A trust policy that names the account root ARN as Principal looks tightly scoped. It isn't: any IAM identity in the account with an sts:AssumeRole grant can use it.
An Extra ACE on AdminSDHolder Silently Grants Control Over Every Protected AD Account
An ACE added to AdminSDHolder for a low-privilege automation account was propagated by SDProp to every protected AD group member, granting silent domain-wide admin control.
Aggregation Labels on Custom ClusterRoles Silently Expand Kubernetes RBAC Permissions
One aggregation label on a new ClusterRole can quietly widen what every edit- or admin-bound identity in the cluster can do, without a single RoleBinding ever changing.
S3 Block Public Access Silently Overrides an Explicit Bucket Policy Grant
A syntactically valid S3 bucket policy grant can still be denied because Block Public Access settings, evaluated separately from the policy, silently override it.
Enabling DNS Aging Without Server-Level Scavenging Never Removes Stale Active Directory Records
Zone-level DNS aging and server-level scavenging are independent switches in Active Directory DNS. Enabling one without the other leaves stale records silently in place.