Pipeline Pwn: The Five Deadly Sins

You've been hired to audit a CI/CD pipeline for a fintech startup. They claim their DevSecOps practices are "industry-leading," but you suspect otherwise. Below are excerpts from their actual pipeline configuration and infrastructure-as-code files.

Terraform main.tf snippet:

code copy
resource "aws_s3_bucket" "data_lake" {
  bucket = "fintech-customer-data-prod"
  acl    = "public-read"
}

resource "aws_security_group" "app_sg" {
  ingress {
    from_port   = 0
    to_port     = 65535
    protocol    = "tcp"
    cidr_blocks = ["0.0.0.0/0"]
  }
}

Kubernetes deployment.yaml snippet:

code copy
apiVersion: v1
kind: Pod
metadata:
  name: payment-processor
spec:
  containers:
  - name: api
    image: fintech/payment:latest
    securityContext:
      privileged: true
      runAsUser: 0

.gitlab-ci.yml snippet:

code copy
stages:
  - build
  - deploy

build_image:
  stage: build
  script:
    - docker build -t app:$CI_COMMIT_SHA .
    - echo $DOCKER_PASSWORD | docker login -u $DOCKER_USER --password-stdin
  artifacts:
    reports:
      container_scanning: gl-container-scanning-report.json

deploy_prod:
  stage: deploy
  script:
    - kubectl apply -f deployment.yaml
  when: manual

OWASP ZAP scan output (truncated):

code copy
[WARN] SQL Injection found: /api/users?id=1' OR '1'='1
[INFO] X-Frame-Options header missing
[HIGH] Hardcoded JWT secret in /config endpoint response: "secret123prod"

Dockerfile snippet:

code copy
FROM ubuntu:20.04
RUN apt-get update
COPY app /app
COPY .env /app/.env
EXPOSE 8080
CMD ["/app/server"]

Your task: Identify the FIVE critical security misconfigurations across these files. The flag is the concatenation of these five issues in alphabetical order, separated by underscores. Use these exact terms: hardcoded_secrets, missing_image_scan, privileged_container, public_s3, wide_open_sg. Example format (not the answer): issue_a_issue_b_issue_c_issue_d_issue_e