Default credentials on the PostgreSQL admin interface - Directory listing enabled on the static file server - Stack traces exposed in production error responses - Unnecessary HTTP methods enabled (PUT, DELETE on static resources) - S3 buckets with public read access