# Reduce attack surface with Claude before you chase individual CVEs

> Have Claude inventory what code is reachable by default, before authentication, and under conflicting config options, then gate or feature-flag what you do not need, and prove the change with the project tests.

- **Category:** [Coding](https://stepgleam.com/categories/coding)
- **Difficulty:** Advanced
- **Time:** ~60 minutes
- **Tools:** Claude Code, Git
- **Reliability score:** 80/100
- **Steps:** 6
- **Last updated:** 2026-10-28
- **Published:** 2026-10-28

## Tools used

- [Claude Code](https://code.claude.com/docs) — Runs the reachability passes and proposes gates or feature flags
- [Git](https://git-scm.com) — Review the patch before you ship it

## What you'll get

A smaller set of reachable code paths, with gates or feature flags for anything that is not needed by default, checked against the project test suite.

## Who this is for

Developers who own a codebase (or an open-source dependency they can patch) and want Claude to shrink what an unauthenticated client can reach before they hunt individual CVEs.

## Before you start

Anthropic's Frontier Red Team (Chris Rohlf, 20 Oct 2026) ran Claude over 25 open-source projects and found 493 attack-surface issues, including unnecessary pre-auth reachability in OpenSSH that later shipped as fixes in 10.5 and 10.6. Separately, Joel Parker Henderson used the same idea on his Vix IDE repo by asking Claude to move features behind Cargo feature flags. This guide sticks to those two sources. Anthropic says they are packaging the three-pass method as a Claude skill for OSS-Scanner; that skill file is not published here, so the steps describe the method rather than inventing a skill file. Models sometimes refuse security work on your own code; that limitation is noted, not worked around with invented prompts.

## Steps

### Step 1: Classify the project as Public, Gated or Private

**Tool:** Claude Code

Anthropic buckets projects by who can reach them: *Public* serves any user who can hit the service, *Gated* expects authentication before useful functionality, and *Private* serves the operator's own environment. That framing decides what "unnecessary" means. In their run, gated projects produced the most surprising early-reachability findings.

**Why this works:** Without that label, Claude cannot tell intended pre-auth surfaces from accidental ones.

**Prompt:**

```
Classify this project as Public, Gated or Private using Anthropic's definitions, and list the main network or protocol entry points.
```

[Open step 1](https://stepgleam.com/guides/reduce-attack-surface-with-claude-before-chasing-cves#step-1)

### Step 2: Pass 1: find code the default config can reach but intended features never use

**Tool:** Claude Code

First pass, with a fresh context: look for code that is reachable in the shipped default configuration but is not used by any intended default functionality. For each finding Claude *"designs and implements a gate and ensures that this causes no change in the program's default behavior"* by running the project's own test suite plus a black-box regression suite against the baseline, and requiring identical results. Gates that would change a non-default configuration are set aside for a human.

**Prompt:**

```
With a fresh context: inventory entry points reachable under the default configuration that no intended default feature uses. For each, propose a gate that keeps default behaviour identical. Run the project test suite (and a black-box regression suite if we have one) against baseline and gated builds.
```

[Open step 2](https://stepgleam.com/guides/reduce-attack-surface-with-claude-before-chasing-cves#step-2)

### Step 3: Pass 2: find complex or security-sensitive code that runs before a hard gate

**Tool:** Claude Code

Second pass, again with an empty context except a short note from the prior pass: look for security-sensitive or complex code that runs before authentication, without victim interaction, or before a protocol state-machine entry point, in any configuration. Anthropic's OpenSSH case study is the concrete example: ML-DSA-44 parsing was reachable by an unauthenticated client even when the algorithm was not enabled; the maintainers later moved the allow-list check before parsing.

**Prompt:**

```
Fresh context. From the entry points, find complex or security-sensitive code that runs before authentication or before a protocol state transition. Propose reordering the allow-list or config check so it runs before parsing or deserialization.
```

[Open step 3](https://stepgleam.com/guides/reduce-attack-surface-with-claude-before-chasing-cves#step-3)

### Step 4: Pass 3: find configuration pairs that silently weaken a control

**Tool:** Claude Code

Third pass: combinations of options that look reasonable alone but, together, silently turn a security control off, leave behaviour undefined, or leave a listener reachable after the admin thinks it is disabled. Anthropic found 162 such combinations across the 25 projects; in 94 of them a control was silently switched off. Claude proposes rejecting the combination at config load, or documenting and guarding it.

**Prompt:**

```
Fresh context. Inventory security-relevant configuration options. Find pairs that the software accepts without error or warning and that silently disable or degrade a security control. Propose rejecting the pair at config load, or a guard that matches the documented intent.
```

[Open step 4](https://stepgleam.com/guides/reduce-attack-surface-with-claude-before-chasing-cves#step-4)

### Step 5: Confirm every finding with a dynamic trace before you keep the patch

**Tool:** Claude Code

In every pass, Anthropic has Claude *"create an inventory of the entry points from the code and confirms each finding with a dynamic trace of the program."* A static guess is not enough. Keep only findings you can reproduce that way, then review the patch yourself.

**Why this works:** Static guesses invent reachability; a trace shows it.

**Prompt:**

```
For each candidate finding, show a dynamic trace that proves the code path is reachable under the stated configuration, then keep only the confirmed ones.
```

[Open step 5](https://stepgleam.com/guides/reduce-attack-surface-with-claude-before-chasing-cves#step-5)

### Step 6: Or shrink the surface by moving features behind flags, then build a minimal binary

**Tool:** Claude Code

Joel Parker Henderson applied the same tactic to Vix IDE with this prompt: *"Goal: rework to reduce the attack surface. Process: move features into feature-flag Rust crates. Output: build a minimal version. Questions: Ask me anything."* Claude (Fable/Opus/Sonnet) split the codebase into separate crates and Cargo features so a security-oriented user can pick capabilities, and so an auditor can look at one capability at a time. He points at the commit messages in the repo rather than pasting them here.

**Why this works:** Feature flags turn "reachable by default" into an explicit opt-in.

**Prompt:**

```
Goal: rework to reduce the attack surface. Process: move features into feature-flag Rust crates. Output: build a minimal version. Questions: Ask me anything.
```

[Open step 6](https://stepgleam.com/guides/reduce-attack-surface-with-claude-before-chasing-cves#step-6)

## Pro tips

- Treat Public, Gated and Private projects differently; gated projects are where early reachability is most surprising.
- Any gate that would change a non-default configuration is a human decision, not an automatic merge.

## Common mistakes

- Asking Claude only to find CVEs and skipping reachability; Anthropic argues fixing one vuln says nothing about the rest.
- Expecting Claude or Codex to always help with defensive security work; some developers report the models refuse audits or PoCs on their own code.

## FAQ

### Is there a ready-made Claude skill I can install?

Anthropic says they are integrating a three-pass skill into OSS-Scanner. This guide does not invent that file. Use the method below, or wait for the published skill.

### Will Claude always cooperate on security work?

Not always. One HN commenter with years of history had to switch models for early CVE investigation because Claude and Codex refused, then switched back for the fix.

---

Canonical guide: https://stepgleam.com/guides/reduce-attack-surface-with-claude-before-chasing-cves
Read this guide as Markdown: https://stepgleam.com/guides/reduce-attack-surface-with-claude-before-chasing-cves.md