How I Built a GitHub Actions Pipeline for OWASP A02 Security Misconfiguration
1. Introduction
- OWASP Top 10:2025 moved Security Misconfiguration to #2 (up from #5 in 2021).
- It is no longer a “boring admin issue.” Highly configurable software + cloud defaults made it extremely common.
- One sentence on what this article covers: real examples of A02, why manual checks fail, and the open-source GitHub Actions pipeline I built to automate the checks.
2. What Security Misconfiguration Actually Looks Like
2.1 Weak TLS still alive in 2026
- Many teams assume “we use HTTPS” is enough.
- Reality: old protocols (TLS 1.0 / 1.1) and weak ciphers are still enabled on production-looking sites.
the Nmap `ssl-enum-ciphers` screenshot showing TLSv1.0 and TLSv1.1 highlighted.
Classic A02 finding: the site presents a valid certificate, yet still offers TLS 1.0 and 1.1.
2.2 Overly permissive CORS + sensitive data in responses
- `Access-Control-Allow-Credentials: true` combined with a broad or missing origin policy is dangerous.
- Returning `apikey`, session tokens, or PII in JSON makes the misconfiguration immediately exploitable.
- The Burp Suite Repeater screenshot with the green boxes on `Access-Control-Allow-Credentials: true` and the JSON body containing username / apikey / sessions.
Caption suggestion:
Misconfiguration is not theoretical. Here the API returns an API key and session identifiers while advertising credentialed cross-origin access.*
2.3 Why these keep happening
- Default framework and cloud settings are permissive by design.
- “It works in staging” becomes production.
- No automated regression check after every change.
3. Why Manual Checks Are Not Enough
- Short paragraph: audits are periodic, configuration drifts daily.
- Shift-left needs something that runs on every push and every week without a human remembering to open Burp or Nmap.
4. The Tool: OWASP A02 Security Misconfiguration CI
Get Gabriel Odusanya’s stories in your inbox
Join Medium for free to get updates from this writer.
4.1 What I built
- A ready-to-copy GitHub Actions workflow that targets the most common A02 gaps.
- Open source, MIT licensed.
- Link: https://github.com/gabbytech01/owasp-a02-github-ci
(adjust if your exact repo name is different)
the GitHub file tree screenshot showing `LICENSE`, `README.md`, `owasp-a02-misconfig.yml`, and the `github-repo` folder.
Caption suggestion:
Repo layout: drop the workflow into `.github/workflows/` or use the whole folder as a template.
4.2 What the pipeline actually runs
the screenshot of the open `owasp-a02-misconfig.yml` file showing the workflow name, triggers, and comments about `APP_URL`.
Caption suggestion:
The workflow file itself — triggers on push, PR, weekly schedule, and manual dispatch.
4.3 How to use it in 60 seconds
1. Copy `owasp-a02-misconfig.yml` → `.github/workflows/`
2. Repo → Settings → Secrets and variables → Actions → Variables
Add `APP_URL` = your staging URL
3. (Optional) Secret `NUCLEI_TARGETS` for extra hosts
4. Push or click **Run workflow**
Emphasize: point it only at systems you own. Staging first.
5. What the Pipeline Does *Not* Do (honesty section)
- It does not replace a full penetration test.
- It does not automatically log into authenticated areas (unless you extend ZAP).
- A green run does not mean “the application is safe.”
- It reduces the cheap, high-frequency A02 failures that keep appearing in real incidents and audits.
— -
6. Closing
- Security Misconfiguration climbed to #2 because the attack surface of configuration exploded.
- Automation turns a checklist that humans forget into something that runs on every change.
- Link the repo again and invite feedback / improvements.
Grab the workflow, point it at staging, and stop treating misconfiguration as a one-time hardening exercise.
