The request "harden" is ambiguous: it does not name a product or platform. The sources show several tools that harden different things: GitHub Actions workflows 111, AWS agents for production readiness 12, Anthropic's code-modernization plugin 313, OpenClaw host auditing 414, Better Auth authentication configuration 616, and Convex app authorization 919. Please specify what you want to harden.
A question back: What do you want to harden: a GitHub Actions workflow, a deployed AI agent, a self-hosted OpenClaw host, an authentication setup, a Convex app's authorization, or a legacy codebase?
Sources
- 1GitHub · Change is constant. GitHub keeps you ahead. · GitHub · GitHubgithub.com · read 2026-10-29
- 3Home \ Anthropicanthropic.com · read 2026-10-29
- 4Fully Managed OpenClaw Hosting — AI Assistant — OpenClaw.Directopenclaw.direct · read 2026-10-29
- 6Better Authbetter-auth.com · read 2026-10-29
- 9Convex | All gas, no breakagesconvex.dev · read 2026-10-29
- 11github-actions-hardening: declares "github-actions-hardening" (the record we read and signed)unfragile.ai · read 2026-10-24
- 12agents-harden: declares "agents-harden" (the record we read and signed)unfragile.ai · read 2026-10-24
- 13code-modernization: declares "code-modernization/command/modernize-harden" (the record we read and signed)unfragile.ai · read 2026-10-24
- 14healthcheck: declares "healthcheck" (the record we read and signed)unfragile.ai · read 2026-10-24
- 16better-auth-security-best-practices: declares "better-auth-security-best-practices" (the record we read and signed)unfragile.ai · read 2026-10-24
- 19convex-authz: declares "convex-authz" (the record we read and signed)unfragile.ai · read 2026-10-24
For agents: the 10 actions behind this answer
github-actions-hardening · github-actions-hardening verified and signed
Security hardening reviewer for GitHub Actions workflow files (.github/workflows/*.yml). Reasons about the Actions threat model that pattern matchers and general code linters miss — untrusted-input script injection, privileged triggers running fork code, mutable action references, and over-scoped to
agents-harden · agents-harden verified and signed
Use when preparing your agent for production — IAM scoping, inbound auth (JWT, SigV4), secrets management, cold start optimization, session lifecycle, rate limiting, input validation, and quota guidance. Triggers on: "production checklist", "harden agent", "production ready", "secure agent", "inboun
code-modernization/command/modernize-harden · code-modernization verified and signed
Slash command /modernize-harden (in the code-modernization plugin)
healthcheck · healthcheck verified and signed
Audit/harden OpenClaw hosts: SSH, firewall, updates, exposure, backups, disk encryption, gateway security.
harmonic_centrality · neo4j-gds found in code, not yet checked
better-auth-security-best-practices · better-auth-security-best-practices verified and signed
Configure rate limiting, manage auth secrets, set up CSRF protection, define trusted origins, secure sessions and cookies, encrypt OAuth tokens, track IP addresses, and implement audit logging for Better Auth. Use when users need to secure their auth setup, prevent brute force attacks, or harden a B
hinting · typing verified and signed
video-enhancement · relighting verified and signed
Task: Video enhancement
convex-authz · convex-authz verified and signed
Audit and harden a Convex app's authorization: identity-from-arg impersonation, missing per-document ownership checks, public queries leaking data by a client-supplied id, and writes into a parent/container the caller doesn't own. Scans for the 4 shapes, applies requireIdentity/requireOwner, verifie
learning · etils verified and signed
Labels are the instruments' verdict and are never changed by ranking. Agents and robots get this same answer as JSON at /api/v1/find?q=…&answer=1 and through the MCP server.