Sec Appsec Web Baseline

Web Security Baseline Audit

Overview

Harden + audit a site's HTTP/web-security baseline the same way the responsive skill does layout: measure every dimension with a tool (never hand-read one curl -I), fix, and re-scan until the gate is clean (0 SEVERE / 0 MEDIUM). Roll changes out in the safe order so a wrong HSTS/CSP never locks users out.

The skill owns these dimensions and nothing else:

1. Security response headers - CSP, HSTS, X-Content-Type-Options, X-Frame-Options/frame-ancestors, Referrer-Policy, Permissions-Policy, Cross-Origin-Opener-Policy, X-XSS-Protection (must be 0).
2. Cookie flags - Secure / HttpOnly / SameSite on every Set-Cookie.
3. Transport - HTTP->HTTPS 301/308 redirect, no mixed content. (TLS version is NOT graded by audit_headers.py; a clean scan says nothing about TLS 1.2/1.3-only. Check it by hand with testssl.sh or openssl s_client -tls1_1 if it matters.)
4. Information leakage - server/framework version tokens.

Use the Read tool to load the reference below before proposing fixes.

Reference files

Bundled scripts

Workflow

1. Scan      -> uv run audit_headers.py https://host   (save the baseline; scan representative pages, not just /)
2. Diagnose  -> map each finding to references/security-headers.md; sort SEVERE -> MEDIUM -> MINOR
3. Propose   -> concrete config diffs (exact header values); APPLY ONLY AFTER the user confirms
4. Roll out  -> the SAFE ORDER (TLS -> safe headers -> CSP report-only -> CSP enforced -> HSTS short -> HSTS long+preload)
5. Verify    -> re-scan to 0 SEVERE / 0 MEDIUM on every audited page; state the numbers

A finding is fixed only when a re-scan shows it gone on every page - never claim "secured" without the re-run (cross-ref bitranox:process-review-verification-before-completion).

Preferred patterns (opinionated defaults)

Defaults this skill prescribes; deviate only with a reason. Full values + snippets in the reference.

• Set headers on EVERY response, always. nginx add_header ... always; so 4xx/5xx are covered.
• Stage the dangerous ones. HSTS: max-age=300 for a week, THEN 31536000; includeSubDomains; preload. CSP: ship Content-Security-Policy-Report-Only for >=48h, fix violations, THEN enforce. preload is a ~1-year one-way door - only when every subdomain serves HTTPS forever.
• CSP without 'unsafe-inline'/'unsafe-eval' in scripts - use a nonce/hash for inline scripts; 'unsafe-inline' is tolerable only in style-src. Add upgrade-insecure-requests.
• X-XSS-Protection: 0 (or omit). The legacy auditor is removed and buggy; never 1.
• Gate on the local scanner, not an external grader (Observatory/csp-evaluator move and rate-limit) - use those only as a bonus cross-check.
• Audit a PUBLIC site from OUTSIDE the internal network. Headers/TLS/redirects are usually added at the edge (Traefik/CDN); a scan from inside hits the origin (internal DNS -> internal IP, no edge headers) and grades the wrong thing. Egress externally: --proxy http://<proxy> for one page, or fan a multi-page worklist across net-rotating-proxies (fast, parallel), ideally in SUBAGENTS (cross-ref bitranox:process-agents-dispatching-parallel) so each scan's output stays out of the main context. Gate proxy-health on a written output file, NOT the scanner's exit code (which is the security verdict, not a connection signal).

Scope boundary (hand off to sibling skills)

Common mistakes