SG-040: Unauthenticated Network Service

Severity: HIGH

Auth disabled / empty creds / trust-all in service config

Fires when

• A service config sets auth to none / disabled / off (or noauth)
• ALLOW_EMPTY_PASSWORD is enabled (Bitnami pattern)
• Redis has an empty password (empty REDIS_PASSWORD or requirepass "")
• Postgres uses the trust-all auth method

Remediation

No safe remediation: a file that triggers this rule should be rejected, not patched. Read the flagged lines in the source before deciding.