What it is
An operator configures a control the platform really supports. A component in the path does not implement it, ignores it or drops it in a transformation. There is no error, no warning and no documentation of the gap. The control looks configured and is inert.
The defect is the absence of signal. A system that refused the request would be secure, and one that warned would be recoverable.
Variants and records
1. Parsed but unused
A setting is read and checked, and then nothing ever acts on it.
How to look: find where the setting is read, then check that something downstream uses it.
2. Dropped in translation
A field passes validation and is then lost when data is converted between components or protocols.
How to look: compare the fields before and after each serialization step or protocol adapter.
3. One backend, not its sibling
A control works on the path the maintainers use, but not on the default path. vLLM lets a request carry a salt that keeps customers' cache entries apart. LMCache's default connector ignored it, so requests with different salts could share an entry, with no error.
LMCache issue 2878. Closed as not planned on 2026-07-13. PR 2880 closed unmerged.
4. Overridden by a default
A later default, profile or environment variable quietly switches off what you configured.
How to look: print the effective configuration at startup and compare it with what you set.
5. Documented but refactored away
The design document describes a control that a later change deleted.
How to look: compare the controls in the design document with the code at each release.
6. Fail-open on the unsupported case
A component meets an input it does not implement and carries on without the protection instead of refusing.
How to look: send each component an input it does not implement and see whether it refuses.
One rule. Fail closed: a component that cannot honor a security input refuses the request.
Check your stack
Tests
Each test has a positive control: a condition under which it must fail. A test that cannot fail proves nothing. These are procedures. Hedgerow has not run them.
Control removal
- Do
- For each control, write a test that checks its effect, then remove the control.
- Pass
- The test fails once the control is removed.
- Must fail when
- The control is removed. If the test still passes, it was not testing the control.
Sibling parity
- Do
- Run the same isolation test on each backend, connector and fast path.
- Pass
- All behave the same.
- Must fail when
- A sibling known to lack the control.
Unsupported input
- Do
- Send a security field a component does not implement.
- Pass
- Refusal.
- Must fail when
- A component known to ignore it.
Mapping to AISVS, ATLAS and CWE
| Framework | Mapping |
|---|---|
| OWASP AISVS 1.01 | No requirement found on fail-closed handling or silent loss of configured controls, by keyword search of 1.01. |
| MITRE ATLAS 5.6.0 | No technique fits well. |
| CWE | CWE-1188 Initialization of a Resource with an Insecure Default is only adjacent. No close CWE for a silently inert control; treat as unmapped. |
Controls
- Fail closed. A component that cannot honor a security-relevant input refuses the request.
- Assert controls in integration tests rather than trusting configuration.
- When adding a second implementation of anything, diff it against the first for security behavior.
What this page does not claim
- The tests have not been run by Hedgerow.
- Standards mappings reflect the versions named and may change as they do.
- A cited record shows the mechanism occurred in at least one implementation. It does not say any given system is affected.