---
name: security-harden
description: Generate Grade A security configuration — settings, instructions, .gitignore additions
---

# Security Harden

Generate reference security configuration based on current posture gaps.

## Step 1: Generate Recommendations

```bash
node <plugin-root>/scanners/reference-config-generator.mjs $ARGUMENTS
```

If `$ARGUMENTS` is empty, scan current working directory. Parse JSON output: `projectType`, `posture`, `recommendations[]`, `summary`.

## Step 2: Present Recommendations

Show table of recommended changes with: file, change description, current state, recommended state.

## Step 3: Apply (if confirmed)

If user confirms (or `--apply` flag is set):
```bash
node <plugin-root>/scanners/reference-config-generator.mjs $ARGUMENTS --apply
```

## Step 4: Verify

Re-run posture scanner to verify grade improvement:
```bash
node <plugin-root>/scanners/posture-scanner.mjs $ARGUMENTS
```

Report: Grade before → Grade after. If still below A, explain remaining gaps that require manual configuration (hooks, custom settings).