Exposingsensitiveenvironmentvariables inlogs“It works onmy machine”response tosecurityconcernsLack ofRBAC(everyone isan admin)Outdateddependencywith knownCVEsUsingeval() inproductioncodeMissingsecurityheaders(CSP, HSTS,etc.)No loggingor monitoringfor securityevents"We don’thave timefor security"excuseUnpatchedcriticalvulnerabilityin productionIgnoringsecuritywarnings independencyscansHardcodedcredentialsin sourcecodeLoggingsensitivedata inplaintextLack ofratelimiting onAPIsOpen sourcelibrarywithout asecurityreviewNo securitytesting inCI/CDpipelineUnencrypteddatabasestorage forPIINo inputvalidationon userinputSQL querywithoutparameterizedinputsAPI keyexposedin a publicrepositoryMergingcode withcriticalsecurityissuesDisabledMFA onan adminaccountPublic S3bucket withsensitivedataDefaultpasswordsstill in useDeveloperssharingpasswordsviaSlack/emailExposingsensitiveenvironmentvariables inlogs“It works onmy machine”response tosecurityconcernsLack ofRBAC(everyone isan admin)Outdateddependencywith knownCVEsUsingeval() inproductioncodeMissingsecurityheaders(CSP, HSTS,etc.)No loggingor monitoringfor securityevents"We don’thave timefor security"excuseUnpatchedcriticalvulnerabilityin productionIgnoringsecuritywarnings independencyscansHardcodedcredentialsin sourcecodeLoggingsensitivedata inplaintextLack ofratelimiting onAPIsOpen sourcelibrarywithout asecurityreviewNo securitytesting inCI/CDpipelineUnencrypteddatabasestorage forPIINo inputvalidationon userinputSQL querywithoutparameterizedinputsAPI keyexposedin a publicrepositoryMergingcode withcriticalsecurityissuesDisabledMFA onan adminaccountPublic S3bucket withsensitivedataDefaultpasswordsstill in useDeveloperssharingpasswordsviaSlack/email

Software Engineering COP Bingo - Call List

(Print) Use this randomly generated list as your call list when playing the game. There is no need to say the BINGO column name. Place some kind of mark (like an X, a checkmark, a dot, tally mark, etc) on each cell as you announce it, to keep track. You can also cut out each item, place them in a bag and pull words from the bag.


1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
  1. Exposing sensitive environment variables in logs
  2. “It works on my machine” response to security concerns
  3. Lack of RBAC (everyone is an admin)
  4. Outdated dependency with known CVEs
  5. Using eval() in production code
  6. Missing security headers (CSP, HSTS, etc.)
  7. No logging or monitoring for security events
  8. "We don’t have time for security" excuse
  9. Unpatched critical vulnerability in production
  10. Ignoring security warnings in dependency scans
  11. Hardcoded credentials in source code
  12. Logging sensitive data in plaintext
  13. Lack of rate limiting on APIs
  14. Open source library without a security review
  15. No security testing in CI/CD pipeline
  16. Unencrypted database storage for PII
  17. No input validation on user input
  18. SQL query without parameterized inputs
  19. API key exposed in a public repository
  20. Merging code with critical security issues
  21. Disabled MFA on an admin account
  22. Public S3 bucket with sensitive data
  23. Default passwords still in use
  24. Developers sharing passwords via Slack/email