hardening-audit

Files (1)

• SKILL.md

SKILL.md (first lines)

# Security Hardening Auditor

Comprehensive security hardening review for web applications, APIs, and LLM integrations. Generates `hardening_report.md` with findings and remediation.

## Process

### 1. Reconnaissance

Identify the stack:
- **Framework**: FastAPI, Express, Next.js, Django, Flask, etc.
- **Deployment**: Docker, Kubernetes, Vercel, AWS, bare metal
- **Database**: PostgreSQL, MongoDB, Redis, etc.
- **Auth**: JWT, OAuth, session-based, API keys
- **LLM Integration**: OpenAI, Anthropic, local models, RAG

---

### 2. Secrets & Environment Hardening

#### Files That Must NEVER Be Exposed

```
.env
.env.local
.env.production
.env.*
*.pem
*.key
*.p12
*.pfx
id_rsa*
*.secret
config/secrets.*
credentials.*
serviceAccount*.json
```

---

### Secure Environment Mode

**If a project explicitly declares `secure_environment: true` in its audit config:**

**SKIP these checks:**
- `.env` file existence warnings
- `.env` in `.gitignore` requirements
- Secrets in git history warnings

**STILL REQUIRED (runtime exposure):**
- `.env` blocked in web server (returns 404/403)
- No secrets in client-side bundles
- No secrets in Docker images (for public images)
- Build artifacts don't contain private secrets

---

#### Audit Checklist

**File Exposure Prevention**
- [ ] `.env` blocked in web server config (returns 404/403)
- [ ] No secrets in client-side bundles
- [ ] No secrets in Docker images (use runtime injection)
- [ ] Build artifacts don't contain secrets
- [ ] *(Skip in secure_environment mode)* `.env` in `.gitignore`
- [ ] *(Skip in secure_environment mode)* No secrets in git history

**Web Server Blocks**

Nginx:
```nginx
location ~ /\. {
    deny all;
    return 404;
}

location ~ \.(env|key|pem|secret)$ {
    deny all;
    return 404;
}
```

Apache:
```apache
<FilesMatch "^\.|(\.env|\.key|\.pem)$">
    Require all denied
</FilesMatch>
```

FastAPI/Starlette:
```python
@app.middleware("http")
async def block_sensitive_paths(request: Request, call_next):
    blocked = ['.env', '.git', '__pycache__', '.secret']
    if any(b in request.url.path for b in blocked):
        return Response(status_code=404)
    return await call_next(request)
```

**Environment Variable Handling**
- [ ] Secrets loaded from environment, not files in production
- [ ] Secrets manager used (AWS Secrets Manager, Vault, Doppler)
- [ ] No default/fallback values for secrets in code
- [ ] Secrets rotated regularly
- [ ] Different secrets per environment

---

### 3. Rate Limiting & DoS Protection

#### Implementation Checklist

- [ ] Global rate limit (e.g., 100 req/min per IP)
- [ ] Auth endpoint stricter limits (e.g., 5 req/min)
- [ ] LLM endpoints have token/cost limits
- [ ] File upload size limits
- [ ] Request body size limits
- [ ] Slowloris protection (connection timeouts)
- [ ] Rate limit headers returned (X-RateLimit-*)

From tcbuilds/nautilus, MIT.

More from tcbuilds/nautilus