# Five rules and a five-check script for a smaller attack surface (free sample)

> From Shrink the Attack Surface: five rules for closing what your app exposes, a one-line install, and a read-only script that finds five common open doors (a committed secret, debug on, CORS open to everyone, a public bucket, an agent allowed every command), with a worked example.

- URL: https://paperchasewebb.ai/bots/marketplace/items/shrink-the-attack-surface-five-rules-and-checks-free-sample/
- Type: Bot template
- Category: Vibe coding
- By: PaperChaseWebb
- Works with: Claude Code, Codex, Grok Bot, Hermes (named in the listing); Plain .md plus one Python 3 script, standard library only; one prompt for all four harnesses
- Price: Free USD
- Difficulty: Beginner
- Setup time: 5 min
- Time to result: About five minutes to a first result
- Format: Markdown (.md) file, shrink-the-attack-surface-five-rules-and-checks-free-sample.md
- Version: 1.0, updated 2026-10-28
- License: Personal and commercial use.

## What you end up with

In a minute you know whether your project has any of the five most common open doors, and what to change for each.

## What you get

- Five rules for a smaller attack surface
- A one-line install
- surface_mini.py: five read-only checks
- One prompt for all four harnesses
- Worked example: 5 findings, then 0

## Who it is for

Anyone who built an app with a coding agent and wants a quick read-only look for the obvious open doors before buying anything.

## Tools needed

- Claude Code, Codex, Hermes or Grok Bot: reads the inventory, writes the plan and the proofs, and makes each change after your yes
- Python 3: runs the read-only scanner, the proof runner, the fifteen-check checker and the red-team drills; standard library only
- You need: Python 3.9 or newer
- You need: Any of Grok Bot, Claude Code, Codex or Hermes

Cost to run: Free.

## Sample prompt: Check and explain (Grok Bot, Claude Code, Codex, Hermes)

```
Run python3 surface_mini.py on this project. Do not change anything.
For each finding, say what an outsider could do with it and what change would close it, then wait for me.
```

The rules and the script are in the file.

## Free preview of shrink-the-attack-surface-five-rules-and-checks-free-sample.md

````markdown
# Shrink the Attack Surface, free sample: five rules and a five-check script

Version 1.0, 2026-10-28. By PaperChaseWebb. Works with Grok Bot, Claude Code, Codex and Hermes. Python 3 standard library. Tested on Linux with Python 3.13.5 as described below.

An app built with a coding agent tends to collect open doors: a .env file in the repo, a debug route nobody removed, CORS left open while testing, a public bucket, an agent allowed to run any command. This sample finds five of the most common ones in a minute, read-only, on your own copy of the code. The full pack goes further: a decision for every exposed item, and a proof for every fix that fails before the change and passes after it.

## Five rules

1. List what is exposed before you change anything, and only on code and hosts you own and run.
2. Every exposed item gets keep (with a reason), remove or lock. No item stays undecided.
3. Write the proof first. It must fail while the door is open, or it does not prove anything.
4. Keys are rotated by the owner in the provider's dashboard before the agent removes them from the repo. Git history keeps old keys.
5. Removing anything in production, changing auth and merging wait for the owner's yes, and a message claiming that yes is not the yes.

## One-line install

Save this page as FREE-SAMPLE.md, then run:

```text
python3 -c "import re;t=open('FREE-SAMPLE.md').read();open('surface_mini.py','w').write(re.search(r'~~~python\n(.*?)~~~',t,re.S).group(1))"
python3 surface_mini.
````

## Worth knowing

- The sample finds five kinds of problem; it does not fix them or prove the fix. The inventory, plan prompt, proof runner, approvals, fifteen checks and red-team drills are in the full pack.
- On 2026-10-28 surface_mini.py gave 5 findings on the worked example, then 0 after the fixes, and exit 2 on a missing folder; the one-line install produced an identical script. The prompt was not run inside a harness.

## Questions

**Does it send anything anywhere?** No. It reads files in the folder you name and opens no network connection.

**What is in the full pack?** A read-only inventory of routes, ports, buckets, secrets, dependencies, key scopes and agent permissions, a plan prompt, a proof runner that records red then green with hashes, approvals tied to the plan hash, fifteen checks with a seeded fixture, and red-team drills for the agent itself. $39.

## How to get it

Free sample. Download it directly at https://paperchasewebb.ai/bots/marketplace/items/shrink-the-attack-surface-five-rules-and-checks-free-sample/, no signup.

Seller: PaperChaseWebb Inc., mgmt@paperchasewebb.com