Insecure default configurations, incomplete hardening, permissive cloud storage, verbose errors, and unpatched frameworks.