harden — shrink the attack surface, prove what you claim

The honest goal: systematic attack-surface reduction + evidence-backed hardening. No tool guarantees 100% security; anyone claiming it is selling something. Every finding states severity and confidence, and every fix is retested.

When NOT to use

• General code quality → referee.
• "Is our architecture scale-resilient?" → headroom.
• Active testing of systems you don't own or lack written authorization for → refuse and explain; this skill audits the user's own/authorized applications only.

Threat model first (the audit is scoped by it)