API keyexposedin a publicrepositoryLack ofRBAC(everyone isan admin)Defaultpasswordsstill in useNo securitytesting inCI/CDpipelineExposingsensitiveenvironmentvariables inlogsMergingcode withcriticalsecurityissuesUnencrypteddatabasestorage forPIIDeveloperssharingpasswordsviaSlack/emailSQL querywithoutparameterizedinputsNo loggingor monitoringfor securityeventsOutdateddependencywith knownCVEsDisabledMFA onan adminaccountHardcodedcredentialsin sourcecodeOpen sourcelibrarywithout asecurityreview“It works onmy machine”response tosecurityconcernsIgnoringsecuritywarnings independencyscans"We don’thave timefor security"excuseUsingeval() inproductioncodeLack ofratelimiting onAPIsLoggingsensitivedata inplaintextMissingsecurityheaders(CSP, HSTS,etc.)Public S3bucket withsensitivedataNo inputvalidationon userinputUnpatchedcriticalvulnerabilityin productionAPI keyexposedin a publicrepositoryLack ofRBAC(everyone isan admin)Defaultpasswordsstill in useNo securitytesting inCI/CDpipelineExposingsensitiveenvironmentvariables inlogsMergingcode withcriticalsecurityissuesUnencrypteddatabasestorage forPIIDeveloperssharingpasswordsviaSlack/emailSQL querywithoutparameterizedinputsNo loggingor monitoringfor securityeventsOutdateddependencywith knownCVEsDisabledMFA onan adminaccountHardcodedcredentialsin sourcecodeOpen sourcelibrarywithout asecurityreview“It works onmy machine”response tosecurityconcernsIgnoringsecuritywarnings independencyscans"We don’thave timefor security"excuseUsingeval() inproductioncodeLack ofratelimiting onAPIsLoggingsensitivedata inplaintextMissingsecurityheaders(CSP, HSTS,etc.)Public S3bucket withsensitivedataNo inputvalidationon userinputUnpatchedcriticalvulnerabilityin production

Software Engineering COP Bingo - Call List

(Print) Use this randomly generated list as your call list when playing the game. There is no need to say the BINGO column name. Place some kind of mark (like an X, a checkmark, a dot, tally mark, etc) on each cell as you announce it, to keep track. You can also cut out each item, place them in a bag and pull words from the bag.


1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
  1. API key exposed in a public repository
  2. Lack of RBAC (everyone is an admin)
  3. Default passwords still in use
  4. No security testing in CI/CD pipeline
  5. Exposing sensitive environment variables in logs
  6. Merging code with critical security issues
  7. Unencrypted database storage for PII
  8. Developers sharing passwords via Slack/email
  9. SQL query without parameterized inputs
  10. No logging or monitoring for security events
  11. Outdated dependency with known CVEs
  12. Disabled MFA on an admin account
  13. Hardcoded credentials in source code
  14. Open source library without a security review
  15. “It works on my machine” response to security concerns
  16. Ignoring security warnings in dependency scans
  17. "We don’t have time for security" excuse
  18. Using eval() in production code
  19. Lack of rate limiting on APIs
  20. Logging sensitive data in plaintext
  21. Missing security headers (CSP, HSTS, etc.)
  22. Public S3 bucket with sensitive data
  23. No input validation on user input
  24. Unpatched critical vulnerability in production