(Print) Use this randomly generated list as your call list when playing the game. There is no need to say the BINGO column name. Place some kind of mark (like an X, a checkmark, a dot, tally mark, etc) on each cell as you announce it, to keep track. You can also cut out each item, place them in a bag and pull words from the bag.
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
Missing security headers (CSP, HSTS, etc.)
Merging code with critical security issues
Developers sharing passwords via Slack/email
No logging or monitoring for security events
Using eval() in production code
Logging sensitive data in plaintext
Default passwords still in use
Unpatched critical vulnerability in production
Outdated dependency with known CVEs
Ignoring security warnings in dependency scans
No input validation on user input
Lack of RBAC (everyone is an admin)
SQL query without parameterized inputs
Disabled MFA on an admin account
API key exposed in a public repository
Unencrypted database storage for PII
No security testing in CI/CD pipeline
Hardcoded credentials in source code
Lack of rate limiting on APIs
Exposing sensitive environment variables in logs
"We don’t have time for security" excuse
Open source library without a security review
Public S3 bucket with sensitive data
“It works on my machine” response to security concerns
