Parse JSON Configs for Insecure Defaults

PayPal Checkout configuration is represented as nested JSON objects and arrays. Given a configuration and a set of security rules, find every configured path whose value matches an insecure default.

Each rule uses a dotted path, such as checkout.security.tls_enabled, and maps to a list of insecure JSON values. A path segment containing * matches exactly one object key or array index, allowing a rule such as merchants.*.logging.debug to apply to every merchant. Return findings sorted lexicographically by their concrete dotted path.

Formal Specification

Implement detect_insecure_defaults(config, rules).

• config is a JSON-compatible Python value composed of dictionaries, lists, strings, numbers, booleans, and None.
• rules is a dictionary mapping dotted rule paths to lists of insecure JSON values.
• The result is a list of dictionaries with keys path and value.
• Report a finding when a rule matches a concrete path and its value equals one of that rule's insecure values.
• Traverse nested objects and arrays. Array indices are path segments such as 0.