Web application frameworks often have many options for developers to choose from that affect how they operate. This choice leads to misconfiguration, as making the wrong decision (or leaving unsecure defaults) leaves security holes attackers use to steal data or otherwise compromise the application.