# Secure by Default

> A design rule that every setting ships in its most restrictive safe state, and weakening one requires an explicit opt-in.

Record: `architecture:secure-by-default`
Kind: principle
Layer: [Security Core](https://banes-lab.com/records/layer/security-core.md)
Severity: mandatory
Scope: configuration, API, product
Aliases: Secure Defaults
Canonical: https://banes-lab.com/ontology#architecture-secure-by-default

Listed in [Architecture principles](https://banes-lab.com/api/records/architecture.md), after [Zero Trust Architecture](https://banes-lab.com/records/architecture/zero-trust-architecture.md) and before [Attack Surface Reduction](https://banes-lab.com/records/architecture/attack-surface-reduction.md).

## Repair

- Refactored by: Change Default to Secure, Require Explicit Opt-In
- Detected by: insecure default config
- Violated by: default open access, default weak settings
- Measured by: insecure default count
- Enforced by: config policy

## Requires

- [Safe Defaults](https://banes-lab.com/records/lexicon/safe-defaults.md)

## Reinforces

- [Fail Secure](https://banes-lab.com/records/architecture/fail-secure.md)

## Enables

- [Reduced Misconfiguration Risk](https://banes-lab.com/records/lexicon/reduced-misconfiguration-risk.md)

## Conflicts with

- [Insecure Defaults](https://banes-lab.com/records/lexicon/insecure-defaults.md)

## In tension with

- [Ease of Initial Use](https://banes-lab.com/records/lexicon/ease-of-initial-use.md)

## Tensions

- [Secure by Default / Ease of Initial Use](https://banes-lab.com/records/tension/ease-of-initial-use-secure-by-default.md)

## Severity

- [mandatory](https://banes-lab.com/records/vocabulary/severity-mandatory.md)

## Category

- [Security / Privacy / Compliance / Governance](https://banes-lab.com/records/architecture-category/security-privacy-compliance-governance.md)

## Enforced by

- [rules/eslint/no-inline-style-write.eslint.rule.ts](https://banes-lab.com/source/governance/rules/eslint/no-inline-style-write.eslint.rule.ts.md)

## Required by

- [Security by Design](https://banes-lab.com/records/architecture/security-by-design.md)

## Reinforced by

- [Parameterized Queries](https://banes-lab.com/records/architecture/parameterized-queries.md)

## Linked from

- [Fail at the boundary](https://banes-lab.com/disciplined-methodology/build/fail-at-the-boundary.md)
- [Systems built around a model](https://banes-lab.com/software-architecture/scale/systems-built-around-a-model.md)
- [Error Handling / Resilience](https://banes-lab.com/ontology/principles/architecture-category-error-handling-resilience.md)
- [Security / Privacy / Compliance / Governance](https://banes-lab.com/ontology/principles/architecture-category-security-privacy-compliance-governance.md)
- [Core Vocabulary](https://banes-lab.com/ontology/lexicon/lexicon-category-core-vocabulary.md)
- [Security Privacy Compliance](https://banes-lab.com/ontology/lexicon/lexicon-category-security-privacy-compliance.md)
- [Severity levels](https://banes-lab.com/ontology/schema/the-vocabulary-severity.md)
- [The resolutions](https://banes-lab.com/ontology/schema/the-resolutions.md)