Security Hygiene Checklist

The problem

Leaking secrets is a disaster, but the structural misconfigurations that lead to those leaks often go unnoticed during development. Manual audits are tedious, and simple secret scanners miss the underlying setup issues like missing gitignore rules or disabled TLS verification.

What it does

• Identifies sensitive files like .env or .pem that are already committed to git history.
• Scans for dangerous configuration patterns including wildcard CORS and disabled SSL/TLS verification.
• Flags active debug modes in application config files that could expose stack traces.
• Validates .gitignore coverage against common credential and key patterns.
• Checks for missing dependency lockfiles to ensure supply chain consistency.

Frameworks & tools

Works with any codebase. Specifically detects patterns for Python (requests, Flask/Django), Node.js, and standard web configuration formats.

Why this beats prompting it yourself

Writing a prompt to find "security issues" often results in hallucinations or missed edge cases like git-tracked files. This skill uses a codified heuristic approach to check specific, high-risk structural patterns that a generic LLM pass would likely overlook.

Use cases

• Pre-launch audits to ensure production settings are hardened.
• Reviewing a private repo before making it public or open-source.
• Baseline security checks when onboarding a legacy codebase.
• Quick hygiene passes before major releases.

Known limitations

This is a heuristic configuration scanner, not a full static analysis (SAST) or dependency vulnerability (CVE) tool. It cannot confirm if a flagged file is actually used in production.