Skip to main content

Bundles/security-hardening

Security Hardening Audit

security-hardening · v2.2.0 · paid

Comprehensive security review covering auth, data validation, secrets management, transport security, and error handling.

Authentication & Session Management

auth-session · weight 0.3

Password hashing uses bcrypt, argon2, or scrypt
ab-002386
critical
Session tokens are cryptographically random and at least 128 bits
ab-002373
critical
Secrets stored in environment variables and never committed to code
ab-002374
critical
CSRF tokens on state-changing requests
ab-002376
high
Session timeout enforced server-side with 30-minute idle limit
ab-002377
high
Account lockout after repeated failed login attempts
ab-002375
high
Rate limiting enforced on authentication endpoints
ab-002408
high
JWT validation covers signature, algorithm, expiry, and audience
ab-002406
high

Input Validation & Injection Prevention

input-validation · weight 0.25

SQL injection prevention via parameterized queries or ORM
ab-002407
high
XSS prevention through proper output escaping
ab-002405
high
Encryption at rest for sensitive data
ab-002398
high
SSRF prevention on outbound requests
ab-002397
medium
File upload validation enforced server-side
ab-002399
medium
XML external entity (XXE) prevention
ab-002396
medium
OAuth state parameter validated on callback
ab-002400
medium
Multi-factor authentication available
ab-002403
medium
Command injection prevention
ab-002404
medium
Server-side input validation enforced
ab-002402
medium

Secrets & Configuration Management

secrets-config · weight 0.2

Encryption in transit using TLS 1.2 or higher
ab-002401
high
Dependency vulnerability scanning enabled
ab-002394
low
Configuration management separates environment-specific values from code
ab-002393
low
CORS configuration is restrictive
ab-002395
low
Path traversal prevention
ab-002411
low
Deserialization attack prevention
ab-002413
low

Dependency & Supply Chain Security

dependency-security · weight 0.15

Package dependencies locked to specific versions
ab-002412
low
Outdated dependencies patched within 30 days for high and critical CVEs
ab-002409
low
Subresource Integrity hashes for third-party CDN scripts
ab-002410
low
Principle of least privilege for database and service accounts
ab-002420
low
Secure defaults enforced in production
ab-002422
low

Infrastructure & Monitoring

infra-monitoring · weight 0.1

Software Bill of Materials or dependency tree reviewed
ab-002421
info
Security logging and audit trails for auth events
ab-002419
info
Secrets not exposed in error messages or logs
ab-002414
info
.env and secrets files listed in .gitignore
ab-002416
info
Threat modeling or security architecture review completed
ab-002417
info