Default-credential checks

What it is

A deterministic check for weak and default credentials on a service you have authorised. It tries the same well-known logins a pentester tries first — admin/admin, vendor defaults, shipped demo accounts — every time, in the same order, with every attempt written to the audit log.

No AI is involved, so the answer never varies between runs and nothing is counted against your monthly allowance.

What it produces

For each service checked:

• A list of any matched default-credential combinations (with the exact request/response that proved it)
• One finding per match, recorded in the same findings table as AI-driven discoveries, so they show up in the same dashboard and reports
• The matched product’s category badge (“Web admin panel”, “DB admin”, “Router admin”, etc.)

What to use it for

• New-acquisition triage: “did they leave any boxes on default admin passwords?”
• M&A due diligence: cheap, audit-ready evidence the surface is / isn’t credential-exposed
• The pre-AI quick win: scan a target, immediately default-check, THEN spend AI tokens on the harder CVEs

Why it matters

Default credentials are still in the OWASP Top 10 and CISA’s Known-Exploited Vulnerabilities catalogue. Most security tools don’t check them because the checks look “noisy”, but tools that DO check them find them constantly. We make the check first-class and cost-free at runtime.

Why it’s valuable

• Free. Running it never spends a Check, on any plan.
• Deterministic. Run it twice on the same service, get the same result. Patch and re-run, the row flips green.
• Same findings pipeline. Default-credential hits get the same ticketing / sharing / replay treatment as AI verdicts.

How to use it

1. Open a service detail drawer.
2. Click Run default-credential test.
3. Result lands in the findings dashboard within seconds.

Or via the API:

POST /api/default-logins
{ "service_id": 12345 }

You authorise the test; we record that you did. Don’t run this against services you don’t own. That’s a CFAA / Computer Misuse Act issue, and the checkbox is a record we asked.