{"id":85,"date":"2026-10-18T02:52:33","date_gmt":"2026-10-17T21:22:33","guid":{"rendered":"https:\/\/nomorebreach.com\/blog\/?p=85"},"modified":"2026-10-18T03:07:40","modified_gmt":"2026-10-17T21:37:40","slug":"the-5-misconfigurations-we-find-on-almost-every-startup","status":"publish","type":"post","link":"https:\/\/nomorebreach.com\/blog\/the-5-misconfigurations-we-find-on-almost-every-startup\/","title":{"rendered":"The 5 Misconfigurations We Find on Almost Every Startup"},"content":{"rendered":"<p><!-- WordPress post body. Title\/category\/tags are passed on the command line. --><\/p>\n<p>When people imagine how a startup gets breached, they picture a genius attacker and a zero-day. In our experience, the damaging stuff is far more boring. The <strong>common security misconfigurations<\/strong> we find are default settings nobody turned off, keys nobody rotated, and a DNS record nobody finished. We find most of them from the outside, before we ever touch your code.<\/p>\n<p>To be clear about the title: &#8220;almost every startup&#8221; is our own field observation, not a statistic. What is on the record is that OWASP&#8217;s Top 10 for 2025 ranks <a href=\"https:\/\/top10.owasp.org\/2025\/A02_2025-Security_Misconfiguration\">Security Misconfiguration<\/a> at A02, the number two web application risk, up from number five in the 2021 edition. It is a common failure, and it is usually fixable in an afternoon.<\/p>\n<p>Startups are especially exposed for understandable reasons: speed beats hardening, infrastructure gets spun up by hand, defaults never get revisited, and nobody owns security full time. That is not a moral failing. It is just where the gaps live. Here are the five we see most, each with what it is, why it bites, and how to check it.<\/p>\n<h2>1. Cloud storage that is open to the world<\/h2>\n<p>An S3 bucket (or a GCS bucket, or an Azure Blob container) whose contents anyone can read with the URL. Think backups, user uploads, logs, sometimes whole database exports. OWASP&#8217;s A02 category explicitly calls out improperly configured permissions on cloud services.<\/p>\n<p>Here is the nuance that trips teams up. Since April 2023, AWS enables S3 Block Public Access and disables ACLs by default, but <strong>for new buckets only<\/strong>. Existing buckets were not changed. A bucket created before that, or one that was explicitly made public, or one fronted by a permissive bucket policy, can still be wide open. &#8220;AWS made it safe by default&#8221; is only true going forward, for buckets created after the change.<\/p>\n<p>How it bites startups: someone made a bucket public early on &#8220;so the frontend can load images&#8221; and never revisited it, or a staging bucket quietly holds production data.<\/p>\n<h3>Check and fix<\/h3>\n<ul>\n<li>Turn on S3 Block Public Access at the <strong>account level<\/strong>, not just per bucket, and keep it on.<\/li>\n<li>Audit your <strong>existing<\/strong> buckets. The default change did not retroactively fix them.<\/li>\n<li>Serve public assets through a CDN such as CloudFront with an origin access identity, not through a public bucket.<\/li>\n<li>Keep production data out of staging and dev buckets.<\/li>\n<\/ul>\n<h2>2. Email anyone can spoof (SPF and DMARC left half-done)<\/h2>\n<p>If your domain has no enforced email authentication, an attacker can send mail that appears to come from <code><span \n                data-original-string='6zazvlDaecfA1ESJARPiaA==b3d+J\/474Mm1E263\/KnLdWmc\/BV1Vmx6frReitlz1Ed9i8='\n                class='apbct-email-encoder'\n                title='This contact has been encoded by Anti-Spam by CleanTalk. Click to decode. To finish the decoding make sure that JavaScript is enabled in your browser.'>fo<span class=\"apbct-blur\">*****<\/span>@<span class=\"apbct-blur\">*********<\/span>ny.com<\/span><\/code>. That is the raw material for phishing and business email compromise aimed at your staff, customers, and investors.<\/p>\n<p>Three standards work together:<\/p>\n<ul>\n<li><strong>SPF<\/strong> (RFC 7208) lists which servers may send mail for your domain.<\/li>\n<li><strong>DKIM<\/strong> (RFC 6376) cryptographically signs messages.<\/li>\n<li><strong>DMARC<\/strong> (RFC 7489) adds an alignment check against the visible From address and tells receivers what to do when a message fails. It builds on SPF and DKIM; it does not replace them.<\/li>\n<\/ul>\n<p>The most common half-done state is a DMARC record published with <code>p=none<\/code>. That is monitoring only: it asks receivers to take no enforcement action and just send you reports. Many teams publish it, see &#8220;DMARC: yes&#8221; in a checker, and assume they are finished. Left at <code>p=none<\/code> indefinitely, your domain is effectively unprotected against direct spoofing.<\/p>\n<pre><code>_dmarc.yourcompany.com.  TXT  \"v=DMARC1; p=none; rua=mailto:re*****@*********ny.com\" title=\"This contact has been encoded by Anti-Spam by CleanTalk. Click to decode. To finish the decoding make sure that JavaScript is enabled in your browser.\" data-original-string=\"KSxa0DPTeculhZIDG6OiMw==b3d9kKR2i+\/gHzf8mkBM8J9a+K7w3t+pA9GvnTNxDeix3Y=\"\n                                          ^^^^^^ monitoring only, not enforcing<\/code><\/pre>\n<p>Enforcing looks like <code>p=quarantine<\/code> or <code>p=reject<\/code>. All of this is visible in public DNS, so it is one of the first things external recon flags.<\/p>\n<h3>Check and fix<\/h3>\n<ul>\n<li>Publish SPF and DKIM, then DMARC. Start at <code>p=none<\/code> only to collect reports.<\/li>\n<li>Move to <code>p=quarantine<\/code>, then <code>p=reject<\/code>. Treat <code>p=none<\/code> as a stage, not a destination.<\/li>\n<\/ul>\n<h2>3. Secrets shipped to the browser<\/h2>\n<p>API keys, tokens, or credentials embedded in client-side JavaScript bundles, mobile app binaries, or committed to a public or forkable repo. Anything that reaches the client is readable. Minified is not hidden.<\/p>\n<p>The distinction that matters is <strong>publishable versus privileged<\/strong>. A publishable or &#8220;anon&#8221; key that is designed to be public, and is protected by server-side rules, is fine. Do not panic about those. The danger is a secret key that can read other users&#8217; data, send email, or spend money, sitting in client-reachable code.<\/p>\n<p>How it bites startups: a frontend calls a third-party API directly with a secret key instead of going through the backend, a <code>.env<\/code> file gets committed, or a mobile app has a hardcoded cloud key. Here is what it looks like, with an obviously fake placeholder:<\/p>\n<pre><code>\/\/ Shipped in the frontend bundle: visible to anyone via DevTools, Sources\nconst client = new PaymentsAPI({\n  secretKey: \"sk_live_xxxxxxxxxxxxxxxxxxxxxxxx\"  \/\/ privileged key, now public\n});<\/code><\/pre>\n<p>Open DevTools on your own site and search the loaded JavaScript for <code>key<\/code>, <code>secret<\/code>, and <code>token<\/code>. If a privileged secret is in there, it is in there for everyone.<\/p>\n<h3>Check and fix<\/h3>\n<ul>\n<li>Keep privileged secrets server-side. The browser or app calls <em>your<\/em> backend, which holds the key.<\/li>\n<li>OWASP&#8217;s A02 guidance recommends identity federation, short-lived credentials, or platform role-based access instead of static keys or secrets in code, configs, or pipelines.<\/li>\n<li>Scan repos and bundles for secrets in CI.<\/li>\n<li><strong>Rotate anything that ever shipped.<\/strong> Assume exposed means compromised.<\/li>\n<li>Check compiled mobile apps too. Strings in a binary are easy to extract.<\/li>\n<\/ul>\n<h2>4. Debug mode and verbose errors left on in production<\/h2>\n<p>Production running with debug or verbose error handling, so a failure hands the user a stack trace, framework version, file paths, SQL, or config. Also in this bucket: exposed <code>.git<\/code> directories, readable <code>.env<\/code> files, and directory listing switched on. OWASP&#8217;s A02 category lists error handling that reveals stack traces or overly detailed messages, and describes a server with directory listing left enabled.<\/p>\n<p>Every leaked detail is a free map for an attacker: the framework and version to match against known vulnerabilities, internal paths, table names, and occasionally secrets right in the trace. This is a generic, made-up example for illustration:<\/p>\n<pre><code>HTTP 500 - Traceback (most recent call last):\n  File \"\/srv\/app\/payments\/charge.py\", line 88, in process\n    conn = psycopg2.connect(\"host=prod-db ... password=...\")\ndjango.db.utils.OperationalError: ...<\/code><\/pre>\n<p>A stranger should get a generic &#8220;something went wrong,&#8221; never this.<\/p>\n<h3>Check and fix<\/h3>\n<ul>\n<li>Set the framework to production mode (<code>DEBUG = False<\/code> or its equivalent) and verify it in the <strong>actual<\/strong> production environment, not just locally.<\/li>\n<li>Use centralized error handling: generic messages to users, full detail in server-side logs.<\/li>\n<li>Block web access to <code>.git<\/code>, <code>.env<\/code>, and backups, and disable directory listing.<\/li>\n<li>Drop version banners and headers you do not need.<\/li>\n<\/ul>\n<h2>5. Admin panels, dashboards, and default credentials on the open internet<\/h2>\n<p>Internal tooling reachable from anywhere: admin consoles, staging environments, metrics and queue dashboards, databases on default ports, often still carrying default or unchanged credentials. OWASP&#8217;s A02 covers exactly this: default accounts and passwords left enabled, and unnecessary ports, services, pages, and accounts left running.<\/p>\n<p>How it bites startups: things get stood up fast with a &#8220;we&#8217;ll lock it down later&#8221; promise. A staging box with real data and <code>admin\/admin<\/code>. A database bound to <code>0.0.0.0<\/code>. A monitoring dashboard with no auth at all.<\/p>\n<p>This is external recon bread and butter. Subdomains such as <code>admin.<\/code>, <code>staging.<\/code>, and <code>dev.<\/code> show up in certificate transparency logs and internet-wide scans, so attackers find them automatically.<\/p>\n<h3>Check and fix<\/h3>\n<ul>\n<li>Put internal tools behind a VPN, SSO, or an IP allow-list.<\/li>\n<li>Change every default credential and require auth on <strong>every<\/strong> dashboard, including the &#8220;internal&#8221; ones.<\/li>\n<li>Close ports and retire services and subdomains you are not using.<\/li>\n<li>Never put production data in an internet-reachable staging environment.<\/li>\n<\/ul>\n<h2>The 2-minute startup security checklist<\/h2>\n<ol>\n<li><strong>Buckets:<\/strong> Is account-level Block Public Access on, and have you audited your older buckets?<\/li>\n<li><strong>Email:<\/strong> Is DMARC at <code>p=quarantine<\/code> or <code>p=reject<\/code>, or is it still <code>p=none<\/code> or missing?<\/li>\n<li><strong>Secrets:<\/strong> Search your frontend bundle for <code>secret<\/code>, <code>key<\/code>, and <code>token<\/code>. Is any privileged secret in there?<\/li>\n<li><strong>Errors:<\/strong> Trigger an error in production. Do you get a generic message or a stack trace?<\/li>\n<li><strong>Exposure:<\/strong> From a logged-out browser on an unrelated network, can you reach any admin, staging, or dashboard page?<\/li>\n<\/ol>\n<p>Most of this can be checked from the outside, with no access to your systems. That is precisely how attackers start, and how we start too. The deeper logic bugs, like the broken access control we covered in our earlier IDOR post, are a different job: they need a human who understands your app.<\/p>\n<hr>\n<p><strong>Want to know what an attacker sees first?<\/strong> Our free external attack-surface snapshot looks for exactly these kinds of exposures, with no access needed and no cost. For the logic bugs scanners miss, we also do manual penetration testing and AI\/LLM red teaming. Start here: <a href=\"https:\/\/nomorebreach.com\/#snapshot\">nomorebreach.com<\/a>.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Five common security misconfigurations, from open cloud storage to unenforced DMARC, that we see on startups and that you can check in an afternoon.<\/p>\n","protected":false},"author":1,"featured_media":92,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[40],"tags":[42,43,44,41],"class_list":["post-85","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-appsec","tag-appsec","tag-cloud-security","tag-devsecops","tag-security-misconfiguration"],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v28.1 - https:\/\/yoast.com\/product\/yoast-seo-wordpress\/ -->\n<title>The 5 Misconfigurations We Find on Almost Every Startup - NoMoreBreach Insights<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/nomorebreach.com\/blog\/the-5-misconfigurations-we-find-on-almost-every-startup\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"The 5 Misconfigurations We Find on Almost Every Startup - NoMoreBreach Insights\" \/>\n<meta property=\"og:description\" content=\"Five common security misconfigurations, from open cloud storage to unenforced DMARC, that we see on startups and that you can check in an afternoon.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/nomorebreach.com\/blog\/the-5-misconfigurations-we-find-on-almost-every-startup\/\" \/>\n<meta property=\"og:site_name\" content=\"NoMoreBreach Insights\" \/>\n<meta property=\"article:published_time\" content=\"2026-10-17T21:22:33+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2026-10-17T21:37:40+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/nomorebreach.com\/blog\/wp-content\/uploads\/2026\/10\/5-misconfigurations-we-find-on-almost-every-startup-1.png\" \/>\n\t<meta property=\"og:image:width\" content=\"1200\" \/>\n\t<meta property=\"og:image:height\" content=\"630\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/png\" \/>\n<meta name=\"author\" content=\"nomorebreachofficial\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@NoMoreBreachSec\" \/>\n<meta name=\"twitter:site\" content=\"@nomorebreach\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"nomorebreachofficial\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"7 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/nomorebreach.com\\\/blog\\\/the-5-misconfigurations-we-find-on-almost-every-startup\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/nomorebreach.com\\\/blog\\\/the-5-misconfigurations-we-find-on-almost-every-startup\\\/\"},\"author\":{\"name\":\"nomorebreachofficial\",\"@id\":\"https:\\\/\\\/nomorebreach.com\\\/blog\\\/#\\\/schema\\\/person\\\/bb2410510214ded6aa0305e6ff04de94\"},\"headline\":\"The 5 Misconfigurations We Find on Almost Every Startup\",\"datePublished\":\"2026-10-17T21:22:33+00:00\",\"dateModified\":\"2026-10-17T21:37:40+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/nomorebreach.com\\\/blog\\\/the-5-misconfigurations-we-find-on-almost-every-startup\\\/\"},\"wordCount\":1350,\"commentCount\":0,\"publisher\":{\"@id\":\"https:\\\/\\\/nomorebreach.com\\\/blog\\\/#organization\"},\"image\":{\"@id\":\"https:\\\/\\\/nomorebreach.com\\\/blog\\\/the-5-misconfigurations-we-find-on-almost-every-startup\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/nomorebreach.com\\\/blog\\\/wp-content\\\/uploads\\\/2026\\\/10\\\/5-misconfigurations-we-find-on-almost-every-startup-2.png\",\"keywords\":[\"appsec\",\"cloud-security\",\"devsecops\",\"security-misconfiguration\"],\"articleSection\":[\"AppSec\"],\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\\\/\\\/nomorebreach.com\\\/blog\\\/the-5-misconfigurations-we-find-on-almost-every-startup\\\/#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/nomorebreach.com\\\/blog\\\/the-5-misconfigurations-we-find-on-almost-every-startup\\\/\",\"url\":\"https:\\\/\\\/nomorebreach.com\\\/blog\\\/the-5-misconfigurations-we-find-on-almost-every-startup\\\/\",\"name\":\"The 5 Misconfigurations We Find on Almost Every Startup - NoMoreBreach Insights\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/nomorebreach.com\\\/blog\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/nomorebreach.com\\\/blog\\\/the-5-misconfigurations-we-find-on-almost-every-startup\\\/#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/nomorebreach.com\\\/blog\\\/the-5-misconfigurations-we-find-on-almost-every-startup\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/nomorebreach.com\\\/blog\\\/wp-content\\\/uploads\\\/2026\\\/10\\\/5-misconfigurations-we-find-on-almost-every-startup-2.png\",\"datePublished\":\"2026-10-17T21:22:33+00:00\",\"dateModified\":\"2026-10-17T21:37:40+00:00\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/nomorebreach.com\\\/blog\\\/the-5-misconfigurations-we-find-on-almost-every-startup\\\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/nomorebreach.com\\\/blog\\\/the-5-misconfigurations-we-find-on-almost-every-startup\\\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/nomorebreach.com\\\/blog\\\/the-5-misconfigurations-we-find-on-almost-every-startup\\\/#primaryimage\",\"url\":\"https:\\\/\\\/nomorebreach.com\\\/blog\\\/wp-content\\\/uploads\\\/2026\\\/10\\\/5-misconfigurations-we-find-on-almost-every-startup-2.png\",\"contentUrl\":\"https:\\\/\\\/nomorebreach.com\\\/blog\\\/wp-content\\\/uploads\\\/2026\\\/10\\\/5-misconfigurations-we-find-on-almost-every-startup-2.png\",\"width\":1200,\"height\":630},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/nomorebreach.com\\\/blog\\\/the-5-misconfigurations-we-find-on-almost-every-startup\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/nomorebreach.com\\\/blog\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"The 5 Misconfigurations We Find on Almost Every Startup\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/nomorebreach.com\\\/blog\\\/#website\",\"url\":\"https:\\\/\\\/nomorebreach.com\\\/blog\\\/\",\"name\":\"No More Breach Insights\",\"description\":\"Stop Threats Before They Start\",\"publisher\":{\"@id\":\"https:\\\/\\\/nomorebreach.com\\\/blog\\\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/nomorebreach.com\\\/blog\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/nomorebreach.com\\\/blog\\\/#organization\",\"name\":\"No More Breach\",\"url\":\"https:\\\/\\\/nomorebreach.com\\\/blog\\\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/nomorebreach.com\\\/blog\\\/#\\\/schema\\\/logo\\\/image\\\/\",\"url\":\"https:\\\/\\\/nomorebreach.com\\\/blog\\\/wp-content\\\/uploads\\\/2025\\\/01\\\/Untitled_design-removebg-preview.png\",\"contentUrl\":\"https:\\\/\\\/nomorebreach.com\\\/blog\\\/wp-content\\\/uploads\\\/2025\\\/01\\\/Untitled_design-removebg-preview.png\",\"width\":500,\"height\":500,\"caption\":\"No More Breach\"},\"image\":{\"@id\":\"https:\\\/\\\/nomorebreach.com\\\/blog\\\/#\\\/schema\\\/logo\\\/image\\\/\"},\"sameAs\":[\"https:\\\/\\\/x.com\\\/nomorebreach\",\"https:\\\/\\\/instagram.com\\\/nomorebreach\"]},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/nomorebreach.com\\\/blog\\\/#\\\/schema\\\/person\\\/bb2410510214ded6aa0305e6ff04de94\",\"name\":\"nomorebreachofficial\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/6d4a84f25c82ed978512f73233e5c099b060eb4a2a74d789a240c355d0e280f4?s=96&r=g\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/6d4a84f25c82ed978512f73233e5c099b060eb4a2a74d789a240c355d0e280f4?s=96&r=g\",\"contentUrl\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/6d4a84f25c82ed978512f73233e5c099b060eb4a2a74d789a240c355d0e280f4?s=96&r=g\",\"caption\":\"nomorebreachofficial\"},\"description\":\"Security Researcher | Bug Bounty Hunter | Pen-Tester | Red Teaming | VAPT | Software Developer | Writer | FOSS | Founder of NoMoreBreach\",\"sameAs\":[\"https:\\\/\\\/nomorebreach.com\\\/blog\",\"https:\\\/\\\/instagram.com\\\/nomorebreach\",\"https:\\\/\\\/www.linkedin.com\\\/company\\\/nomorebreach\",\"https:\\\/\\\/x.com\\\/NoMoreBreachSec\"],\"url\":\"https:\\\/\\\/nomorebreach.com\\\/blog\\\/author\\\/nomorebreachofficial\\\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"The 5 Misconfigurations We Find on Almost Every Startup - NoMoreBreach Insights","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/nomorebreach.com\/blog\/the-5-misconfigurations-we-find-on-almost-every-startup\/","og_locale":"en_US","og_type":"article","og_title":"The 5 Misconfigurations We Find on Almost Every Startup - NoMoreBreach Insights","og_description":"Five common security misconfigurations, from open cloud storage to unenforced DMARC, that we see on startups and that you can check in an afternoon.","og_url":"https:\/\/nomorebreach.com\/blog\/the-5-misconfigurations-we-find-on-almost-every-startup\/","og_site_name":"NoMoreBreach Insights","article_published_time":"2026-10-17T21:22:33+00:00","article_modified_time":"2026-10-17T21:37:40+00:00","og_image":[{"width":1200,"height":630,"url":"https:\/\/nomorebreach.com\/blog\/wp-content\/uploads\/2026\/10\/5-misconfigurations-we-find-on-almost-every-startup-1.png","type":"image\/png"}],"author":"nomorebreachofficial","twitter_card":"summary_large_image","twitter_creator":"@NoMoreBreachSec","twitter_site":"@nomorebreach","twitter_misc":{"Written by":"nomorebreachofficial","Est. reading time":"7 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/nomorebreach.com\/blog\/the-5-misconfigurations-we-find-on-almost-every-startup\/#article","isPartOf":{"@id":"https:\/\/nomorebreach.com\/blog\/the-5-misconfigurations-we-find-on-almost-every-startup\/"},"author":{"name":"nomorebreachofficial","@id":"https:\/\/nomorebreach.com\/blog\/#\/schema\/person\/bb2410510214ded6aa0305e6ff04de94"},"headline":"The 5 Misconfigurations We Find on Almost Every Startup","datePublished":"2026-10-17T21:22:33+00:00","dateModified":"2026-10-17T21:37:40+00:00","mainEntityOfPage":{"@id":"https:\/\/nomorebreach.com\/blog\/the-5-misconfigurations-we-find-on-almost-every-startup\/"},"wordCount":1350,"commentCount":0,"publisher":{"@id":"https:\/\/nomorebreach.com\/blog\/#organization"},"image":{"@id":"https:\/\/nomorebreach.com\/blog\/the-5-misconfigurations-we-find-on-almost-every-startup\/#primaryimage"},"thumbnailUrl":"https:\/\/nomorebreach.com\/blog\/wp-content\/uploads\/2026\/10\/5-misconfigurations-we-find-on-almost-every-startup-2.png","keywords":["appsec","cloud-security","devsecops","security-misconfiguration"],"articleSection":["AppSec"],"inLanguage":"en-US","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/nomorebreach.com\/blog\/the-5-misconfigurations-we-find-on-almost-every-startup\/#respond"]}]},{"@type":"WebPage","@id":"https:\/\/nomorebreach.com\/blog\/the-5-misconfigurations-we-find-on-almost-every-startup\/","url":"https:\/\/nomorebreach.com\/blog\/the-5-misconfigurations-we-find-on-almost-every-startup\/","name":"The 5 Misconfigurations We Find on Almost Every Startup - NoMoreBreach Insights","isPartOf":{"@id":"https:\/\/nomorebreach.com\/blog\/#website"},"primaryImageOfPage":{"@id":"https:\/\/nomorebreach.com\/blog\/the-5-misconfigurations-we-find-on-almost-every-startup\/#primaryimage"},"image":{"@id":"https:\/\/nomorebreach.com\/blog\/the-5-misconfigurations-we-find-on-almost-every-startup\/#primaryimage"},"thumbnailUrl":"https:\/\/nomorebreach.com\/blog\/wp-content\/uploads\/2026\/10\/5-misconfigurations-we-find-on-almost-every-startup-2.png","datePublished":"2026-10-17T21:22:33+00:00","dateModified":"2026-10-17T21:37:40+00:00","breadcrumb":{"@id":"https:\/\/nomorebreach.com\/blog\/the-5-misconfigurations-we-find-on-almost-every-startup\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/nomorebreach.com\/blog\/the-5-misconfigurations-we-find-on-almost-every-startup\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/nomorebreach.com\/blog\/the-5-misconfigurations-we-find-on-almost-every-startup\/#primaryimage","url":"https:\/\/nomorebreach.com\/blog\/wp-content\/uploads\/2026\/10\/5-misconfigurations-we-find-on-almost-every-startup-2.png","contentUrl":"https:\/\/nomorebreach.com\/blog\/wp-content\/uploads\/2026\/10\/5-misconfigurations-we-find-on-almost-every-startup-2.png","width":1200,"height":630},{"@type":"BreadcrumbList","@id":"https:\/\/nomorebreach.com\/blog\/the-5-misconfigurations-we-find-on-almost-every-startup\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/nomorebreach.com\/blog\/"},{"@type":"ListItem","position":2,"name":"The 5 Misconfigurations We Find on Almost Every Startup"}]},{"@type":"WebSite","@id":"https:\/\/nomorebreach.com\/blog\/#website","url":"https:\/\/nomorebreach.com\/blog\/","name":"No More Breach Insights","description":"Stop Threats Before They Start","publisher":{"@id":"https:\/\/nomorebreach.com\/blog\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/nomorebreach.com\/blog\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/nomorebreach.com\/blog\/#organization","name":"No More Breach","url":"https:\/\/nomorebreach.com\/blog\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/nomorebreach.com\/blog\/#\/schema\/logo\/image\/","url":"https:\/\/nomorebreach.com\/blog\/wp-content\/uploads\/2025\/01\/Untitled_design-removebg-preview.png","contentUrl":"https:\/\/nomorebreach.com\/blog\/wp-content\/uploads\/2025\/01\/Untitled_design-removebg-preview.png","width":500,"height":500,"caption":"No More Breach"},"image":{"@id":"https:\/\/nomorebreach.com\/blog\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/x.com\/nomorebreach","https:\/\/instagram.com\/nomorebreach"]},{"@type":"Person","@id":"https:\/\/nomorebreach.com\/blog\/#\/schema\/person\/bb2410510214ded6aa0305e6ff04de94","name":"nomorebreachofficial","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/secure.gravatar.com\/avatar\/6d4a84f25c82ed978512f73233e5c099b060eb4a2a74d789a240c355d0e280f4?s=96&r=g","url":"https:\/\/secure.gravatar.com\/avatar\/6d4a84f25c82ed978512f73233e5c099b060eb4a2a74d789a240c355d0e280f4?s=96&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/6d4a84f25c82ed978512f73233e5c099b060eb4a2a74d789a240c355d0e280f4?s=96&r=g","caption":"nomorebreachofficial"},"description":"Security Researcher | Bug Bounty Hunter | Pen-Tester | Red Teaming | VAPT | Software Developer | Writer | FOSS | Founder of NoMoreBreach","sameAs":["https:\/\/nomorebreach.com\/blog","https:\/\/instagram.com\/nomorebreach","https:\/\/www.linkedin.com\/company\/nomorebreach","https:\/\/x.com\/NoMoreBreachSec"],"url":"https:\/\/nomorebreach.com\/blog\/author\/nomorebreachofficial\/"}]}},"_links":{"self":[{"href":"https:\/\/nomorebreach.com\/blog\/wp-json\/wp\/v2\/posts\/85","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/nomorebreach.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/nomorebreach.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/nomorebreach.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/nomorebreach.com\/blog\/wp-json\/wp\/v2\/comments?post=85"}],"version-history":[{"count":1,"href":"https:\/\/nomorebreach.com\/blog\/wp-json\/wp\/v2\/posts\/85\/revisions"}],"predecessor-version":[{"id":87,"href":"https:\/\/nomorebreach.com\/blog\/wp-json\/wp\/v2\/posts\/85\/revisions\/87"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/nomorebreach.com\/blog\/wp-json\/wp\/v2\/media\/92"}],"wp:attachment":[{"href":"https:\/\/nomorebreach.com\/blog\/wp-json\/wp\/v2\/media?parent=85"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/nomorebreach.com\/blog\/wp-json\/wp\/v2\/categories?post=85"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/nomorebreach.com\/blog\/wp-json\/wp\/v2\/tags?post=85"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}