“It works onmy machine”response tosecurityconcernsDefaultpasswordsstill in useNo loggingor monitoringfor securityeventsUnencrypteddatabasestorage forPIILack ofRBAC(everyone isan admin)No securitytesting inCI/CDpipelineMergingcode withcriticalsecurityissuesUsingeval() inproductioncodeSQL querywithoutparameterizedinputsNo inputvalidationon userinputAPI keyexposedin a publicrepository"We don’thave timefor security"excuseDisabledMFA onan adminaccountLack ofratelimiting onAPIsOutdateddependencywith knownCVEsIgnoringsecuritywarnings independencyscansExposingsensitiveenvironmentvariables inlogsLoggingsensitivedata inplaintextOpen sourcelibrarywithout asecurityreviewMissingsecurityheaders(CSP, HSTS,etc.)Unpatchedcriticalvulnerabilityin productionHardcodedcredentialsin sourcecodePublic S3bucket withsensitivedataDeveloperssharingpasswordsviaSlack/email“It works onmy machine”response tosecurityconcernsDefaultpasswordsstill in useNo loggingor monitoringfor securityeventsUnencrypteddatabasestorage forPIILack ofRBAC(everyone isan admin)No securitytesting inCI/CDpipelineMergingcode withcriticalsecurityissuesUsingeval() inproductioncodeSQL querywithoutparameterizedinputsNo inputvalidationon userinputAPI keyexposedin a publicrepository"We don’thave timefor security"excuseDisabledMFA onan adminaccountLack ofratelimiting onAPIsOutdateddependencywith knownCVEsIgnoringsecuritywarnings independencyscansExposingsensitiveenvironmentvariables inlogsLoggingsensitivedata inplaintextOpen sourcelibrarywithout asecurityreviewMissingsecurityheaders(CSP, HSTS,etc.)Unpatchedcriticalvulnerabilityin productionHardcodedcredentialsin sourcecodePublic S3bucket withsensitivedataDeveloperssharingpasswordsviaSlack/email

Software Engineering COP Bingo - Call List

(Print) Use this randomly generated list as your call list when playing the game. There is no need to say the BINGO column name. Place some kind of mark (like an X, a checkmark, a dot, tally mark, etc) on each cell as you announce it, to keep track. You can also cut out each item, place them in a bag and pull words from the bag.


1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
  1. “It works on my machine” response to security concerns
  2. Default passwords still in use
  3. No logging or monitoring for security events
  4. Unencrypted database storage for PII
  5. Lack of RBAC (everyone is an admin)
  6. No security testing in CI/CD pipeline
  7. Merging code with critical security issues
  8. Using eval() in production code
  9. SQL query without parameterized inputs
  10. No input validation on user input
  11. API key exposed in a public repository
  12. "We don’t have time for security" excuse
  13. Disabled MFA on an admin account
  14. Lack of rate limiting on APIs
  15. Outdated dependency with known CVEs
  16. Ignoring security warnings in dependency scans
  17. Exposing sensitive environment variables in logs
  18. Logging sensitive data in plaintext
  19. Open source library without a security review
  20. Missing security headers (CSP, HSTS, etc.)
  21. Unpatched critical vulnerability in production
  22. Hardcoded credentials in source code
  23. Public S3 bucket with sensitive data
  24. Developers sharing passwords via Slack/email