Insecure default variable initialization