security-hardening

Security Hardening

This skill enforces structured security analysis before code reaches production. It covers the most common vulnerabilities found in backend systems and provides concrete mitigation patterns per category.

When to Use

• Any backend feature that handles user input, file uploads, or external data
• Any task involving authentication, authorization, sessions, or tokens
• Code review with a security focus (/review + security scope)
• Before deploying a new API endpoint, service, or integration to production
• When the codebase is new and no security baseline has been established

When NOT to Use

• Pure frontend UI tasks with no backend interaction
• Infrastructure configuration reviewed separately under a dedicated infra checklist
• Internal tooling with no external network exposure and no user data

Core Principle

Assume breach at every boundary. Every input is hostile, every token is potentially stolen, every dependency is potentially compromised. Security is not a final step — it is a constraint on every design decision.

Security Hardening Process

Use the checklist below and track progress:

Security hardening progress:
- [ ] Step 1: Inventory trust boundaries and data flows
- [ ] Step 2: Audit authentication and authorization
- [ ] Step 3: Validate input handling and injection surface
- [ ] Step 4: Review secrets and credential management
- [ ] Step 5: Check security headers and transport
- [ ] Step 6: Verify dependency and supply chain hygiene
- [ ] Step 7: Produce Security Review output

Step 1: Inventory trust boundaries and data flows

Map every point where untrusted data enters the system:

• HTTP request bodies, query params, headers, cookies
• File upload content and filenames
• Webhook payloads from third parties
• Data read from external APIs or message queues
• Data read from the database that originated from user input

For each entry point, verify: who validates it, where, and how failures are handled.