security-hardening

name	security-hardening
description	Harden an application or service against common attack vectors. Use when asked to improve security posture, secure an API, harden a server, or prepare for a security review.
license	MIT

Overview

Security hardening is not about chasing perfect — it's about raising the cost of attack above the attacker's budget. Work systematically through the layers.

Process

Layer 1: Authentication and Authorization

1. Verify all endpoints require authentication. Check for unprotected routes using:

   grep -rn "route\|@app\.\|router\." src/ | grep -v "login\|health\|docs"
   

2. Check that authorization is enforced at the data layer, not just the route layer. A user who can reach /orders should only see their orders.
3. Confirm tokens expire. JWTs must have exp claims. Sessions must have server-side expiry.

Layer 2: Input Validation

4. Every user-supplied value that touches a database must use parameterized queries. Grep for f-string SQL:

   grep -rn "f\"SELECT\|f'SELECT\|format.*SELECT" src/
   

5. Every file path from user input must be validated against an allowlist or a sandboxed directory. Check for os.path.join(base, user_input) without os.path.abspath + startswith guard.

Layer 3: Secrets and Configuration

6. Scan for hardcoded secrets:

   grep -rn "password\s*=\s*[\"'][^\"']\|api_key\s*=\s*[\"'][^\"']" src/
   

7. Confirm all secrets come from environment variables or a secrets manager, not from config files committed to version control.
8. Check .gitignore includes .env, *.key, *.pem.

Layer 4: Dependencies and Infrastructure

9. Run the dependency-audit skill to check for vulnerable packages.
10. Check HTTP security headers are set (for web services):
    • Content-Security-Policy
    • X-Frame-Options: DENY
    • Strict-Transport-Security
    • X-Content-Type-Options: nosniff

Layer 5: Output

11. Write findings as a prioritized list: Critical → High → Medium → Low. For each finding: what it is, where it is (file:line), how to fix it.

Rationalizations

Excuse	Rebuttal
"This is an internal service, it doesn't need hardening"	Internal services are the primary target of lateral movement attacks after initial breach.
"We'll harden it before the public launch"	Security debt compounds. Fix it before it goes anywhere.
"The framework handles security"	Frameworks handle some things. You must handle the application-level concerns.

Verification

• All four layers were checked (not just the ones that seemed relevant)
• No hardcoded secrets found in source or git history
• Every critical and high finding has a specific remediation
• A finding was produced for each layer — even if it's "no issues found"