Claude Security Reviews

On my random todo list was to make sure I wasn’t doing anything dumb security-wise in the last incarnation of my blog site. So, I sicked Claude on the job:

please conduct a security review of current production copy of site (ie: what’s in the /public directory)

It ground away for a few minutes and produced a nice report with action items to address and some proposed solutions.

Here’s a sampling of some of the issues found:

• Using the default Apache server id string.
• Not using CSP. It carefully reviewed all the client side functionality and made a super details set of custom rules to lock down what happens on client side.
• Problems with images missing from the Wordpress content import that kicked off the latest version of the site on Hugo.
• Links in posts to sites that used to be legit that were taken over by scammers. Cleverly, it found and linked old content in Wayback Machine when available.
• Images that contact location data in EXIF details. Claude easily scrubbed them for privacy.
• Turning off other problematic Apache defaults like automatic directory indexes and support for http TRACE method.

A lot of improvement for a few minutes of Claude’s time and an hour of my time getting the configuration details installed and tested.

Along the way I was able to streamline including personal images in posts. Previously, I would airdrop a picture from phone onto computer, then use a shortcut to resize and change image format before dropping into the bundle for the post. Now, I just drop the unprocessed picture file into the bundle and Hugo does the resize, change format, strip EXIF location operation all automatically. It also generates 2 sizes for better responsive handling. Nice!