What problem does it solve?
Reduces the risk of security vulnerabilities and misconfigurations by providing concrete, repeatable guidance for validating input, protecting secrets, enforcing authentication and authorization, and configuring secure defaults across web applications and APIs.
Core Features & Use Cases
- Input validation at boundaries to prevent injection and malformed data from reaching business logic.
- Authentication and session best practices including password hashing, secure cookies, and rate limiting for auth endpoints.
- Output encoding and header configuration (CSP, HSTS, X-Frame-Options) to mitigate XSS and related attacks.
- Secrets and dependency management guidance to avoid committing credentials and to triage npm audit findings.
- Operational checks such as file upload restrictions, CORS restrictions, and a security review checklist for deployment readiness.
- Use Case: Harden a web API that accepts user uploads and processes payments by validating schemas at the route boundary, restricting origins, enforcing HTTPS, and removing sensitive fields from API responses.
Quick Start
Apply the security-and-hardening checklist to your repository, identify high or critical findings, and generate a prioritized remediation plan.
