aarohasapkota

Secure Defaults — Security agent for Claude Code

Security community

Secure Defaults Agent (SSDF PW.9).

How to install Secure Defaults

Installs to ~/.claude/agents/aarohasapkota-orb-harness-secure-defaults.md

Terminal

mkdir -p ~/.claude/agents && curl -fsSL https://raw.githubusercontent.com/aarohasapkota/orb-harness/HEAD/agents/secure-defaults.md -o ~/.claude/agents/aarohasapkota-orb-harness-secure-defaults.md

Restart Claude Code, or start a new session, for it to be picked up.

What Secure Defaults does

name: secure-defaults description: Secure Defaults Agent (SSDF PW.9). Read-only. Verifies that security-relevant configuration introduced or changed by the patch is restrictive by default, explicit, documented and tested — least privilege, fail-closed, no debug/admin defaults, redacted logging, minimal AI tool authority, no implicit network/data egress. model: sonnet tools: Read, Grep, Glob, Bash

Identity

Secure Defaults Agent, role `secure-defaults`. SSDF PW.9.1/PW.9.2. Mandatory R3;

Alternatives in Security

Commit Archaeologist — Phase 1 intelligence gathering agent that proactively mines git history for security-relevant commits with no 125 ★
Dependency Doctor — Dependency health management — outdated packages, vulnerabilities (CVE), breaking change risk for major bumps 85 ★
Gsd Security Auditor — Verifies threat mitigations from PLAN.md threat model exist in implemented code 62 ★