Claude Code command For developers

Hardening (command)

Contributed by Rohit Ghumare (awesome-claude-code-toolkit)

Source: original file · added 2026-10-29

Apply security hardening measures to the codebase.

Steps

1. HTTP Security Headers

Add or verify these headers in the web server or middleware configuration:

  • Content-Security-Policy: Restrict script sources, disable inline scripts.
  • Strict-Transport-Security: max-age=31536000; includeSubDomains.
  • X-Content-Type-Options: nosniff.
  • X-Frame-Options: DENY or SAMEORIGIN.
  • Referrer-Policy: strict-origin-when-cross-origin.
  • Permissions-Policy: Disable unused browser features (camera, microphone, geolocation).

2. Rate Limiting

  • Add rate limiting to authentication endpoints (5 attempts per minute).
  • Add rate limiting to public API endpoints (100 requests per minute per IP).
  • Implement exponential backoff for repeated failures.
  • Use sliding window counters, not fixed windows.

3. Input Validation

  • Add schema validation (Zod, Joi, Pydantic) to all API endpoints.
  • Sanitize HTML output to prevent XSS: use DOMPurify or equivalent.
  • Validate file upload types, sizes, and names.
  • Implement request body size limits.

4. Output Encoding

  • Ensure all user-provided data is escaped before rendering in HTML, SQL, shell commands, or logs.
  • Use parameterized queries for all database operations.
  • Use template engines with auto-escaping enabled by default.
  • Sanitize data before including in log messages to prevent log injection.

5. Authentication Hardening

  • Enforce minimum password complexity (12+ characters, no common passwords).
  • Implement account lockout after repeated failures.
  • Add multi-factor authentication support if not present.
  • Set secure cookie attributes: HttpOnly, Secure, SameSite=Strict.
  • Implement proper session invalidation on logout.

6. Dependency Hardening

  • Pin exact dependency versions in production.
  • Enable automated dependency updates (Dependabot, Renovate).
  • Remove unused dependencies.
  • Use npm ci instead of npm install in CI.

Rules

  • Apply hardening incrementally. Test after each change.
  • Do not break existing functionality. Security measures should be transparent to legitimate users.
  • Document any hardening that requires configuration changes at deployment time.
  • Verify hardening with automated tests where possible (e.g., test that rate limiting returns 429).
Original source file (unmodified)

Apply security hardening measures to the codebase. ## Steps ### 1. HTTP Security Headers Add or verify these headers in the web server or middleware configuration: - `Content-Security-Policy`: Restrict script sources, disable inline scripts. - `Strict-Transport-Security`: `max-age=31536000; includeSubDomains`. - `X-Content-Type-Options`: `nosniff`. - `X-Frame-Options`: `DENY` or `SAMEORIGIN`. - `Referrer-Policy`: `strict-origin-when-cross-origin`. - `Permissions-Policy`: Disable unused browser features (camera, microphone, geolocation). ### 2. Rate Limiting - Add rate limiting to authentication endpoints (5 attempts per minute). - Add rate limiting to public API endpoints (100 requests per minute per IP). - Implement exponential backoff for repeated failures. - Use sliding window counters, not fixed windows. ### 3. Input Validation - Add schema validation (Zod, Joi, Pydantic) to all API endpoints. - Sanitize HTML output to prevent XSS: use DOMPurify or equivalent. - Validate file upload types, sizes, and names. - Implement request body size limits. ### 4. Output Encoding - Ensure all user-provided data is escaped before rendering in HTML, SQL, shell commands, or logs. - Use parameterized queries for all database operations. - Use template engines with auto-escaping enabled by default. - Sanitize data before including in log messages to prevent log injection. ### 5. Authentication Hardening - Enforce minimum password complexity (12+ characters, no common passwords). - Implement account lockout after repeated failures. - Add multi-factor authentication support if not present. - Set secure cookie attributes: `HttpOnly`, `Secure`, `SameSite=Strict`. - Implement proper session invalidation on logout. ### 6. Dependency Hardening - Pin exact dependency versions in production. - Enable automated dependency updates (Dependabot, Renovate). - Remove unused dependencies. - Use `npm ci` instead of `npm install` in CI. ## Rules - Apply hardening incrementally. Test after each change. - Do not break existing functionality. Security measures should be transparent to legitimate users. - Document any hardening that requires configuration changes at deployment time. - Verify hardening with automated tests where possible (e.g., test that rate limiting returns 429).

Our network