security-hardeninglisted

# Security Hardening Assume every input is hostile, every user is an attacker, and every secret in the repository is already public. Then check whether the code agrees. **Scope:** defensive security — finding and fixing weaknesses in code the user owns or is authorised to assess. Never scan, probe or send traffic to infrastructure without explicit confirmation of ownership or authorisation. Produce fixes and detections, not weaponised exploits. --- ## The order of operations Findings are not equal. Work top-down; the first three account for most real breaches. 1. **Secrets** — anything committed is compromised. 2. **Broken access control** — the most common critical finding in real systems. 3. **Injection** — SQL, command, template, LDAP, NoSQL. 4. **Authentication weaknesses** — sessions, tokens, resets, MFA. 5. **XSS and content injection.** 6. **SSRF and unvalidated redirects.** 7. **Insecure configuration** — headers, debug modes, exposed endpoints. 8. **Supply chain** — dependencies, install scripts, build pipeline. 9. **Cryptographic failures** — at rest, in transit, in tokens. 10. **Logging and monitoring gaps** — an undetected breach is an unbounded one. `references/owasp-checklist.md` carries the full per-category checks. --- ## 1. Secrets — start here, always ```bash git log --all --full-history --name-only -- '*.env' '*.pem' '*.key' '*.p12' '*credential*' | head -30 git ls-files | grep -E '(^|/)\.env($|\.)' | grep -v example ``` Plus the pattern scan in