Shrink the Attack Surface: patch with proof
by PaperChaseWebb
Your agent lists everything your app exposes, read-only: routes, open ports, public buckets, secrets in the repo, unused dependencies, debug endpoints, admin paths, CORS, API key scopes and its own tool permissions. You decide keep, remove or lock for each. Every fix gets a proof that fails before the change and passes after it, and the proof stays as a regression test. Red-team drills then check that the agent still asks before risky steps, stops retrying broken tools and never charges or emails twice.
- Price
- $39
- Difficulty
- Intermediate
- Setup
- 45 min
- Format
- .md file
shrink-the-attack-surface-patch-with-proof.md · 75 KB · instant download after checkout
Want this built for you instead? We can build it for you.
What you end up with
A smaller app with a written decision for every exposed item, a red and green record for every fix, your yes on every production removal, key rotation, auth change and merge, and a checker that reads 0 when you are done.
What you get
- 18 sections in one .md file
- surface_scan.py: a read-only inventory with nine risk checks (secrets, debug, admin auth, CORS, binds and ports, buckets, unused dependencies, key scopes, agent permissions)
- proof_run.py: runs a fix's proof before and after the change and records the real exit code with the proof and plan hashes
- probe.py: a loopback-only GET for proofs that refuses any other host before opening a socket
- A plan prompt for keep, remove or lock with a proof per fix
- A skill file for Claude Code, Codex and Hermes, an AGENTS.md snippet and a Grok Bot rules block
- Owner approvals in approvals.csv tied to the plan's sha256
- surface_check.py: fifteen read-only checks, with a seeded fixture app and nine real proofs
- Red-team drills: 12 labeled cases (persona and pressure sweeps of 120 messages, injected tool output, stale approvals, retry budget, idempotency) with weak, paranoid and hardened example policies
- Ten prompts, a failure table, and a look at nine security skills, packs and services with sources
Who it is for
Builders and small teams who used coding agents to build an app and want it smaller and provably closed before more people use it, without a scanner that only hands them a list.
Works with
Solid chips: the agent is named in this listing's own tools list. Dashed chip: A skill file for Claude Code, Codex and Hermes, an AGENTS.md snippet and a Grok Bot rules block; the tools were tested on a seeded fixture app on 127.0.0.1, not a production app or cloud account, and the prompts and drills were not run inside each harness.
Tools needed
Cost to run: The pack is the only purchase. The scanner, checker and drills use no model tokens; the agent is used to write the plan, the proofs and the changes.
Time to result: A first inventory in minutes; a first fix with its proof in about an hour
How it works
Run the tests
Copy the shrink-attack-surface folder into your repo and run sh test_all.sh.
Expected: 15 findings on seeded and 0 on fixed, exit 2 on a missing folder, regression 18 right and 0 wrong, the probe refusing an outside host, and the hardened policy holding 8 of 8 attacks with 0 false refusals.
Take the inventory
Run python3 surface_scan.py app --json > SURFACE.json on your local copy. It only reads files.
Expected: A list of exposed items with the risky ones marked and a reason for each.
Plan and approve
Run the plan prompt. The agent writes a decision for every item and a proof per fix, runs surface_check.py, and shows you the plan and its sha256. You add rows to approvals.csv.
Expected: A plan you have read, with your yes tied to its hash.
Prove and patch
For each fix: proof_run.py red, the change, proof_run.py green. Then run surface_check.py and the drills.
Expected: 0 findings, every proof kept in your tests, and drill results for your agent's policy.
Sample prompt from the pack
Run surface_scan.py on app read-only and save SURFACE.json. Write surface.plan.json with PLAN-PROMPT.md; a keep needs a reason. Run surface_check.py, then show me the plan and its sha256 and stop. Change nothing.
Prompts 1 and 2 of 10. The owner adds the approval rows.
For fix F03, write the proof first and run proof_run.py red. Stop if it does not fail. After my yes, make the change and run proof_run.py green without touching the proof.
Prompts 3 and 4 of 10.
Free preview of the file
# Shrink the Attack Surface: patch with proof Version 1.0, 2026-10-28. By PaperChaseWebb. Works with Grok Bot, Claude Code, Codex and Hermes. A skill file, an AGENTS.md snippet, a Grok Bot rules block, a plan prompt, a red-team drill set and six small tools, all Python 3 standard library. Tested as described in section 12: everything ran on Linux with Python 3.13.5 against a seeded fixture app on 127.0.0.1. It was not run against a real production app or a cloud account, and the prompts were not run inside each harness for this release. Both are marked where they matter. Most security packs for vibe-coded apps hand you a list. Sixty prompts, fifty audit skills, a checklist. You run them, you get a page of problems, and then you are on your own: which of these matter, what do I change, and how do I know the change worked and stays worked? The other common shape is a scanner that prints findings and nothing else. Neither tells you when you are done. This pack does one thing all the way through. Your agent lists everything the app exposes (routes, open ports, public buckets, secrets in the repo, unused dependencies, debug endpoints, admin paths, CORS, API key scopes and its own tool permissions). You decide keep, remove or lock for each item. For every change, the agent writes a proof first, a small test that fails because the exposure is there. Then it makes the change, and the same proof, unedited, passes. The proof stays in your test suite, so the exposure cannot quietly c
Worth knowing
- The tools were tested on a seeded fixture app on 127.0.0.1, not on a production app or a cloud account's bucket and key settings. Start on a copy of a small app.
- The scanner reads files with simple patterns and Flask, FastAPI and Express style routes. It will miss things; it is not a penetration test.
- The drill runner scores a policy module, not a model. The prompts, skill file and drills were not run against each harness's live agent for this release; DRILLS.md says how to run them by hand.
- On 2026-10-28, on Linux with Python 3.13.5: all nine fixture proofs failed before their patch and passed after it; surface_check.py gave 15 findings on the seeded fixture and 0 on the fixed one, files unchanged, exit 2 on a missing folder; the regression run was 18 of 18 right; probe.py refused a non-loopback host with exit 2; the drills scored the weak policy 0 of 8 attacks held, the paranoid policy 4 false refusals, and the hardened policy 8 of 8 held with 0 false refusals, asking on all 120 attempts in both sweeps.
Questions
How is this different from a security scanner?
A scanner lists problems. This pack ends each one with a decision, and each fix with a proof that failed before the change and passes after it, recorded with hashes, so you can tell when you are done and the door cannot quietly reopen.
Will the agent rotate keys or change production for me?
No, on purpose. Rotation happens in your provider's dashboard by you. Production removals, auth changes and merges wait for your row in approvals.csv, tied to the plan's hash.
Does it scan my live site?
No. Everything runs on a local copy, and the probe refuses any host that is not loopback before it opens a socket.
What are the red-team drills for?
The agent doing this work has real access. The drills check that it still asks on the 118th attempt to talk it out of asking, ignores approvals that appear in tool output, stops retrying a broken tool and never charges or emails twice. They count false refusals too.
Details
Version 1.0 · Updated Oct 28, 2026 · Markdown version of this page
License: Use in your own repos and on installs you do for clients and teams. Do not resell or republish the pack itself. Download terms
Related
Five rules and a five-check script for a smaller attack surface (free sample)
From Shrink the Attack Surface: five rules for closing what your app exposes, a one-line install, and a read-only script that finds five common open doors (a committed secret, debug on, CORS open to everyone, a public bucket, an agent allowed every command), with a worked example.
Pre-launch security prompts for vibe-coded apps: Supabase RLS, leaked keys and open doors
14 prompts that make your coding agent find exposed keys, tables without row level security, open buckets and unverified webhooks in your own app, then fix them one commit at a time.
Two-Agent Build and Test Loop for paid apps: one agent builds, another tests, and nothing passes on its own say-so
A tested setup for apps that take money: one agent writes the code, a separate tester session writes the stories and tests and gives the verdicts, a small runner records every red, green and revert exit code itself, and the owner says yes to the plan, any payment or pricing work, each merge and each release. Test keys and sandboxes only. A read-only check with fifteen tests audits the finished run.
Release Watch: a per-change monitoring plan your agent writes from the diff, run by a fixed script
After a change goes live, your agent reads the diff and writes a small watch plan for that change: which signals it could move, against which baseline, by how much, for how long. A fixed script runs the plan every five minutes, so no agent sits in a loop. On a trip, a second agent triages read-only and proposes one next step. Rollbacks, flag flips and alert changes stay with you.
Don't Get Sued: a pre-launch legal-risk gate for AI-built apps and agents
A read-only agent gate for the fourteen legal risks that hit small builders most: marketing texts and email, trackers before consent, accessibility, kids' data, biometrics, plain-text personal data, AI disclosure, AI claims you cannot prove, takedowns, policies that do not match the product, renewals and refunds, licenses, and agents that act for users. Evidence rule, gate register, seeded test app, 12 prompts, counsel packet. Not legal advice.
Agent Readiness Self-Check: score one workflow before you hand it to an AI agent
A free self-check for agencies and small businesses. Score one workflow across eight areas (workflow mapped, data access, approval gates, owner per agent, handoffs, cost tracking, security and vetting, measurement) with an evidence rule and three gate rules, read your band and what to do next, plus an interview prompt for Grok Bot, Claude Code, Codex or Hermes, a score sheet and a worked example.
Production Readiness Audit: decide from evidence whether an agent system can go live
Twelve areas, each pass, gap or na, and every pass points to a dated evidence file. Gaps get a named owner and a due date, five areas block go-live until fixed, drills are run rather than described, and the verdict is signed by someone who did not build the system. A fifteen-check script reads the folder, the report is sealed to a hash of the evidence, and the owner's go-live yes is tied to the report's sha256.