Security Hardening Checklist (32 Items)

Security hardening is about removing easy failure modes

Most production incidents are not Hollywood-grade attacks. They are plain mistakes: leaked tokens, overly broad permissions, public dashboards, missing audit logs, and forgotten old containers.

Use this checklist as a review frame before exposing Hermes to real users or real infrastructure. The point is not perfection; the point is reducing cheap wins for an attacker and reducing confusion for your own team.

When This Pattern Fits

• Hermes is about to touch live infrastructure, customer data, or public endpoints.
• You already deployed something that works and now need to make it survive production reality.
• You want a repeatable review that different operators can run before each release.

Reference Workflow

Review identity, secrets, and approval boundaries first.

Reduce network exposure and lock down runtime permissions.

Ensure logs, alerts, and backups support incident response.

Repeat the checklist on every material architecture change.

Step 1: Start with secrets and identity

Rotate tokens, remove unused credentials, and verify that each integration has the minimum permissions required. Most teams harden the host before they harden the service accounts, which is backwards.

Identity
least-privilege service accounts
separate read-only and write-capable tokens
mandatory approval for destructive actions

Step 2: Then reduce exposure

Close ports you do not need, require HTTPS, avoid public admin interfaces, and prefer private network paths for internal systems. Exposure reduction usually beats clever detection.

Step 3: Finally make incidents observable

If something goes wrong, you need enough evidence to know who called what, which token was used, and which system changed. Hardening without auditability is incomplete.

Preflight Checklist

• Separate environments and credentials for development, staging, and production.
• Require approval for destructive shell commands and write-capable external actions.
• Disable or protect debug endpoints, admin panels, and unused services.
• Retain logs long enough to investigate incidents and prove what happened.

Troubleshooting

Why call it 32 items if this page does not list all 32 inline?

Because the important part is the review frame: identity, secrets, runtime, network, logging, recovery, and process. Teams usually expand each group into their own environment-specific line items.

What is the first hardening win for a small team?

Least-privilege credentials and explicit approval on destructive actions. Those two controls prevent a large class of avoidable failures.

Can I harden later after launch?

You can, but the cost is usually higher because bad exposure patterns become part of the deployment shape. It is cheaper to make a secure default path now.

Next Steps

• VPS Deployment Guide — Apply the checklist to a single-host deployment.
• Docker Production Deployment — Apply the checklist to a containerized runtime.
• Architecture Walkthrough — Review the runtime with risk boundaries in mind.

---

Last updated: April 14, 2026 · Hermes Agent v0.8