Harden Any Project Automatically

The problem

Manual security reviews are time-consuming and prone to human error. Developers often overlook common vulnerabilities like hardcoded secrets, missing security headers, or unsafe input validation during rapid development cycles.

What it does

• Identifies hardcoded secrets and moves them to environment variables with updated .env.example files.
• Applies secure HTTP headers, CORS configurations, and safe cookie settings based on the project framework.
• Audits dependencies for known vulnerabilities and applies minimal version bumps to resolve them safely.
• Injects input validation and rate limiting on sensitive routes to mitigate injection and brute-force risks.
• Disables verbose production error logging and debug settings that leak system information.

Frameworks & tools

Works with any standard package manager and framework. Utilizes built-in security audit tools (e.g., npm audit), linters, and type checkers to validate changes.

Why this beats prompting it yourself

Generic LLM prompts often suggest massive, breaking refactors or generic advice. This skill follows a strict "minimal change" rule, using framework-specific conventions and validating every fix with actual project tools to ensure your app still builds and runs.

Use cases

• Hardening a web application immediately before a production deployment.
• Cleaning up a legacy codebase to ensure secrets aren't checked into version control.
• Resolving high-priority vulnerabilities identified by automated dependency scanners.
• Improving the security posture of an API by adding missing validation and headers.

Known limitations

Does not perform destructive penetration testing or external network scans. Cannot automatically rotate production secrets or perform major version dependency upgrades without approval.