| name | harden |
| description | Security adversarial validation: derive invariants, attack surface, fuzz targets, credential risks, race conditions, and coverage gaps; extend existing tests to prove fixes. |
Harden
Use this for security and abuse resistance, not ordinary CI cleanup or code polish.
The job is to prove what breaks, fix real weaknesses, and leave tests that catch regressions.
Flow
- Inventory trust boundaries, auth/permission checks, parsers, file/network inputs, secrets, storage, concurrency, and external calls.
- Derive invariants the system must never violate.
- Try to break those invariants with realistic attacks, malformed inputs, race attempts, and credential misuse.
- Reproduce each real issue with the smallest executable proof.
- Fix the root cause, then add or extend the existing test path so the proof fails before the fix and passes after it.
- Rank remaining risk by exploitability and impact.
Attack Checklist
- Broken auth, tenant isolation, IDOR, confused deputy, privilege escalation.
- Injection, unsafe deserialization, path traversal, SSRF, file upload abuse.
- Credential leaks in source, env, logs, artifacts, traces, and screenshots.
- Race conditions, replay, stale authorization, time-of-check/time-of-use bugs.
- Missing coverage around security-critical state transitions.
Output
Report only verified findings and explicitly label unverified hypotheses.
For each finding include evidence, impacted boundary, proof command/test, fix, and residual risk.
Use references/full-reference.md for the full legacy playbook and report template.
Then consider
converge for red CI after the security fix lands.critical-audit for broad code review once exploit paths are covered.
