EXERCISE 1 — Identify the misconfiguration, risk, fix, and amplified category
==============================================================================

(a) A new admin panel still using admin/admin.
    MISCONFIG: default / unchanged credentials.
    RISK: anyone (including automated internet scanners that try known default
    logins) gets full admin access in minutes — total compromise of the app.
    FIX: change the credential before exposure; ship accounts disabled or force
    a strong password on first use; restrict admin-panel access (network/IP/
    MFA). Remove sample/default accounts.
    AMPLIFIES: A07 (Authentication failures) — it's an instant auth bypass; and
    A01 (broken access control) once inside.

(b) Production returning full stack traces.
    MISCONFIG: verbose errors / debug mode enabled in production.
    RISK: leaks framework + version, file paths, DB type, sometimes the failing
    query, env vars, even secrets via debug consoles. It's free reconnaissance
    that accelerates other attacks.
    FIX: disable debug mode in prod; show users a GENERIC error; log full
    details SERVER-SIDE only.
    AMPLIFIES: A06 (version disclosed -> look up known CVEs), A03 (SQL/other
    injection made easier by leaked query/schema), A02 (leaked secrets).

(c) A publicly-readable S3 bucket of user uploads.
    MISCONFIG: open cloud storage (overly permissive bucket policy/ACL).
    RISK: every uploaded file (potentially PII, documents, backups) is readable
    by the entire internet; buckets are routinely enumerated/scanned. A direct
    data breach with no "hack" required.
    FIX: make the bucket private by default; use signed/expiring URLs or
    authenticated access for legitimate downloads; enable "block public access";
    audit existing objects/permissions.
    AMPLIFIES: A02 (cryptographic/sensitive-data exposure) and A01 (access
    control) — it's unauthorized data access by configuration.

(d) .env reachable at /.env.
    MISCONFIG: exposed sensitive file (directory/file served over HTTP that
    shouldn't be).
    RISK: .env typically holds DB credentials, API keys, signing secrets, mail
    creds — fetching it hands over the keys to everything. (Same class: exposed
    .git, backups, config files.)
    FIX: ensure such files are OUTSIDE the web root / blocked by the server;
    deny dotfiles and known sensitive paths; never deploy .env into a
    served directory; rotate any secrets that were exposed.
    AMPLIFIES: A02 (leaked keys/credentials) and A07 (leaked auth secrets);
    effectively a master-key disclosure.

PATTERN:
  In every case the CODE may be fine — the system was left in an insecure
  STATE. And each misconfiguration AMPLIFIES other Top 10 categories: a leak
  feeds injection/known-CVE attacks, a default cred or exposed secret feeds auth
  bypass and data exposure. Misconfigurations rarely stand alone; they lower the
  cost of everything else.