secure-deploy-gatelisted

# Secure deployment gate (harden + scan, verified) Find the security problems in a deployment by **probing it**, and prove the fixes hold — TLS, security headers, exposed ports, and the proxy/container config are gated by checks that run, not by a checklist you tick. ## Core principle **Security posture is measured, not assumed.** The loop is: scan the live target + audit the config → triage by severity → fix the root cause (usually: put a hardened reverse proxy in front and close everything else) → re-scan until the gate is green. **Be honest about scope (the rule that keeps this skill correct):** these are automated configuration and surface checks. A green gate is a **baseline, not a clean bill of health** — it does not find logic flaws, broken authz, injection, or anything needing credentials or human judgement, and it is not a substitute for a real penetration test. Report "0 blocking findings against the encoded checks", never "the deployment is secure". → `references/01-scope-authorization-and-threat-model.md` ## ⚠️ Authorization — read first Active scanning (port connects, TLS handshakes, HTTP requests) may only be run against systems you **own or are contracted to test**. Scanning third-party hosts without permission is illegal in most jurisdictions. The live scanners **refuse to run** until you assert authorization (`"authorized": true` in the config, or `--authorize`). Record who authorized it and for which hosts. The static config audit needs no authorizatio