# Shrink the Attack Surface: patch with proof

> Your agent lists everything your app exposes, read-only: routes, open ports, public buckets, secrets in the repo, unused dependencies, debug endpoints, admin paths, CORS, API key scopes and its own tool permissions. You decide keep, remove or lock for each. Every fix gets a proof that fails before the change and passes after it, and the proof stays as a regression test. Red-team drills then check that the agent still asks before risky steps, stops retrying broken tools and never charges or emails twice.

- URL: https://paperchasewebb.ai/bots/marketplace/items/shrink-the-attack-surface-patch-with-proof/
- Type: Bot template
- Category: Vibe coding
- By: PaperChaseWebb
- Works with: Claude Code, Codex, Grok Bot, Hermes (named in the listing); A skill file for Claude Code, Codex and Hermes, an AGENTS.md snippet and a Grok Bot rules block; the tools were tested on a seeded fixture app on 127.0.0.1, not a production app or cloud account, and the prompts and drills were not run inside each harness
- Price: $39 USD
- Difficulty: Intermediate
- Setup time: 45 min
- Time to result: A first inventory in minutes; a first fix with its proof in about an hour
- Format: Markdown (.md) file, shrink-the-attack-surface-patch-with-proof.md
- Version: 1.0, updated 2026-10-28
- License: Use in your own repos and on installs you do for clients and teams. Do not resell or republish the pack itself.

## What you end up with

A smaller app with a written decision for every exposed item, a red and green record for every fix, your yes on every production removal, key rotation, auth change and merge, and a checker that reads 0 when you are done.

## What you get

- 18 sections in one .md file
- surface_scan.py: a read-only inventory with nine risk checks (secrets, debug, admin auth, CORS, binds and ports, buckets, unused dependencies, key scopes, agent permissions)
- proof_run.py: runs a fix's proof before and after the change and records the real exit code with the proof and plan hashes
- probe.py: a loopback-only GET for proofs that refuses any other host before opening a socket
- A plan prompt for keep, remove or lock with a proof per fix
- A skill file for Claude Code, Codex and Hermes, an AGENTS.md snippet and a Grok Bot rules block
- Owner approvals in approvals.csv tied to the plan's sha256
- surface_check.py: fifteen read-only checks, with a seeded fixture app and nine real proofs
- Red-team drills: 12 labeled cases (persona and pressure sweeps of 120 messages, injected tool output, stale approvals, retry budget, idempotency) with weak, paranoid and hardened example policies
- Ten prompts, a failure table, and a look at nine security skills, packs and services with sources

## Who it is for

Builders and small teams who used coding agents to build an app and want it smaller and provably closed before more people use it, without a scanner that only hands them a list.

## Tools needed

- Claude Code, Codex, Hermes or Grok Bot: reads the inventory, writes the plan and the proofs, and makes each change after your yes
- Python 3: runs the read-only scanner, the proof runner, the fifteen-check checker and the red-team drills; standard library only
- A local copy of your app: proofs start it on 127.0.0.1 and make the request an attacker would make; nothing is pointed at a live host
- You need: Claude Code, Codex, Hermes or Grok Bot
- You need: Python 3.9 or newer
- You need: A local copy of the app you own
- You need: Access to your providers' dashboards for key rotation and bucket settings (the owner does these)

Cost to run: The pack is the only purchase. The scanner, checker and drills use no model tokens; the agent is used to write the plan, the proofs and the changes.

## How it works

1. **Run the tests.** Copy the shrink-attack-surface folder into your repo and run sh test_all.sh. Expected: 15 findings on seeded and 0 on fixed, exit 2 on a missing folder, regression 18 right and 0 wrong, the probe refusing an outside host, and the hardened policy holding 8 of 8 attacks with 0 false refusals.
2. **Take the inventory.** Run python3 surface_scan.py app --json > SURFACE.json on your local copy. It only reads files. Expected: A list of exposed items with the risky ones marked and a reason for each.
3. **Plan and approve.** Run the plan prompt. The agent writes a decision for every item and a proof per fix, runs surface_check.py, and shows you the plan and its sha256. You add rows to approvals.csv. Expected: A plan you have read, with your yes tied to its hash.
4. **Prove and patch.** For each fix: proof_run.py red, the change, proof_run.py green. Then run surface_check.py and the drills. Expected: 0 findings, every proof kept in your tests, and drill results for your agent's policy.

## Sample prompt: Inventory and plan (Grok Bot, Claude Code, Codex, Hermes)

```
Run surface_scan.py on app read-only and save SURFACE.json. Write surface.plan.json with PLAN-PROMPT.md; a keep needs a reason.
Run surface_check.py, then show me the plan and its sha256 and stop. Change nothing.
```

Prompts 1 and 2 of 10. The owner adds the approval rows.

## Sample prompt: Prove one fix (Grok Bot, Claude Code, Codex, Hermes)

```
For fix F03, write the proof first and run proof_run.py red. Stop if it does not fail.
After my yes, make the change and run proof_run.py green without touching the proof.
```

Prompts 3 and 4 of 10.

## Free preview of shrink-the-attack-surface-patch-with-proof.md

````markdown
# Shrink the Attack Surface: patch with proof

Version 1.0, 2026-10-28. By PaperChaseWebb. Works with Grok Bot, Claude Code, Codex and Hermes. A skill file, an AGENTS.md snippet, a Grok Bot rules block, a plan prompt, a red-team drill set and six small tools, all Python 3 standard library. Tested as described in section 12: everything ran on Linux with Python 3.13.5 against a seeded fixture app on 127.0.0.1. It was not run against a real production app or a cloud account, and the prompts were not run inside each harness for this release. Both are marked where they matter.

Most security packs for vibe-coded apps hand you a list. Sixty prompts, fifty audit skills, a checklist. You run them, you get a page of problems, and then you are on your own: which of these matter, what do I change, and how do I know the change worked and stays worked? The other common shape is a scanner that prints findings and nothing else. Neither tells you when you are done.

This pack does one thing all the way through. Your agent lists everything the app exposes (routes, open ports, public buckets, secrets in the repo, unused dependencies, debug endpoints, admin paths, CORS, API key scopes and its own tool permissions). You decide keep, remove or lock for each item. For every change, the agent writes a proof first, a small test that fails because the exposure is there. Then it makes the change, and the same proof, unedited, passes. The proof stays in your test suite, so the exposure cannot quietly c
````

## Worth knowing

- The tools were tested on a seeded fixture app on 127.0.0.1, not on a production app or a cloud account's bucket and key settings. Start on a copy of a small app.
- The scanner reads files with simple patterns and Flask, FastAPI and Express style routes. It will miss things; it is not a penetration test.
- The drill runner scores a policy module, not a model. The prompts, skill file and drills were not run against each harness's live agent for this release; DRILLS.md says how to run them by hand.
- On 2026-10-28, on Linux with Python 3.13.5: all nine fixture proofs failed before their patch and passed after it; surface_check.py gave 15 findings on the seeded fixture and 0 on the fixed one, files unchanged, exit 2 on a missing folder; the regression run was 18 of 18 right; probe.py refused a non-loopback host with exit 2; the drills scored the weak policy 0 of 8 attacks held, the paranoid policy 4 false refusals, and the hardened policy 8 of 8 held with 0 false refusals, asking on all 120 attempts in both sweeps.

## Questions

**How is this different from a security scanner?** A scanner lists problems. This pack ends each one with a decision, and each fix with a proof that failed before the change and passes after it, recorded with hashes, so you can tell when you are done and the door cannot quietly reopen.

**Will the agent rotate keys or change production for me?** No, on purpose. Rotation happens in your provider's dashboard by you. Production removals, auth changes and merges wait for your row in approvals.csv, tied to the plan's hash.

**Does it scan my live site?** No. Everything runs on a local copy, and the probe refuses any host that is not loopback before it opens a socket.

**What are the red-team drills for?** The agent doing this work has real access. The drills check that it still asks on the 118th attempt to talk it out of asking, ignores approvals that appear in tool output, stops retrying a broken tool and never charges or emails twice. They count false refusals too.

## How to buy

$39 one time at https://paperchasewebb.ai/bots/marketplace/items/shrink-the-attack-surface-patch-with-proof/. Stripe checkout, then an instant download page; the download link is also in your emailed receipt.

Seller: PaperChaseWebb Inc., mgmt@paperchasewebb.com