finding-fail-open-flaws

# Finding fail-open flaws: prove the gate denies by default A control fails open when its error, empty, or default path grants access instead of refusing it. The check looks present and even passes its happy-path tests, but on the branch that runs when something goes wrong, when a lookup errors, a list is empty, a value is missing, an exception is caught, it lets the request through. These flaws hide in the paths tests rarely cover, and they turn any upstream failure into an authorization bypass. ## When to use - You are reviewing authentication, authorization, or any access gate. - A check "passes" and you have not confirmed why, or what it does on failure. - A control depends on an external service, a list, or an input that could be absent. ## Scope check Test gates in code you own or are authorized to test, inducing failures against your own environment. If you can't name the authorization, stop. ## The loop 1. **Enumerate the gates and their failure branches.** For each authentication or authorization check in scope, find not just the allow/deny decision but what happens when the check cannot be completed: the lookup throws, the policy service is unreachable, the input is null or unrecognized, the list is empty. Every gate has a failure branch; find it. 2. **Determine the default.** For each gate, is the default deny (access requires an explicit, successful allow) or allow (access proceeds unless something explicitly denies)? Default-allow is the...