# Secure by Default

Record: `arch:secure-by-default`
Kind: principle
Layer: [Security Core](https://banes-lab.com/records/layer/security-core.md)
Severity: mandatory
Scope: configuration, API, product
Canonical: https://banes-lab.com/ontology#arch-secure-by-default

## Repair

- Refactored by: Change Default to Secure, Require Explicit Opt-In
- Detected by: insecure default config
- Violated by: default open access, default weak settings
- Measured by: insecure default count
- Enforced by: config policy

## requires

- [Safe Defaults](https://banes-lab.com/records/lex/safe-defaults.md)

## reinforces

- [Fail Secure](https://banes-lab.com/records/arch/fail-secure.md)

## enables

- [Reduced Misconfiguration Risk](https://banes-lab.com/records/lex/reduced-misconfiguration-risk.md)

## conflicts-with

- [Insecure Defaults](https://banes-lab.com/records/lex/insecure-defaults.md)

## tensions-with

- [Ease of Initial Use](https://banes-lab.com/records/lex/ease-of-initial-use.md)

## tensions

- [Secure by Default Ease of Initial Use](https://banes-lab.com/records/tension/ease-of-initial-use-secure-by-default.md)

## referenced-by

- [Parameterized Queries](https://banes-lab.com/records/arch/parameterized-queries.md)