Application settings have sensible defaults for new users
Why it matters
New users who land in a broken default state — blank required fields, null configuration, a settings page they must complete before anything works — don't file bug reports. They churn silently. ISO 25010 functional suitability covers exactly this failure: the software doesn't do what a new user reasonably expects it to do on first run. Missing defaults also create data integrity hazards: if a default timezone is never set, date math silently breaks on the first query that needs it.
Severity rationale
Medium because blank defaults cause silent functional failures and early churn, but don't expose user data or create a security boundary violation.
Remediation
Define defaults at the database schema level so they're persisted on account creation, not just applied as runtime fallbacks. In prisma/schema.prisma:
model UserSettings {
id String @id @default(cuid())
userId String @unique
emailNotifs Boolean @default(true)
theme String @default("system")
timezone String @default("UTC")
language String @default("en")
}
In your account creation handler, call prisma.userSettings.create({ data: { userId } }) immediately after inserting the user — the schema defaults fill the rest. Never rely on application-layer fallbacks to cover missing rows.
DetectionPro
The detection method for this pattern is part of AuditBuffet Pro.
The full method (what to look for, pass and fail conditions, and how results get reported) ships inside the Onboarding UX Audit. The pattern definition, severity rationale, and remediation remain openly licensed under CC-BY-4.0.
External references
- iso-25010:2011 · functional-suitability — Functional Appropriateness
Taxons
History
- 2026-04-18·v1.0.0·Initial import from saas-onboarding·automated