# Hono Security

> Security audit for Hono applications running on Cloudflare Workers, Bun, Deno, Node, or AWS Lambda — covering middleware setup, JWT helper safety, environment binding handling (c.env), CORS, secret management across runtimes, and Hono-specific patterns. Use this skill whenever the user mentions Hono, hono framework, c.req, c.json, c.env, Hono middleware, Hono on Cloudflare/Bun/Node, or asks "audi…

- **Type:** Skill
- **Install:** `agentstack add skill-hlsitechio-claude-skills-security-hono-security`
- **Verified:** Yes — security-reviewed for prompt injection and unsafe behavior
- **Seller:** [hlsitechio](https://agentstack.voostack.com/s/hlsitechio)
- **Installs:** 0
- **Category:** [Cloud & Infrastructure](https://agentstack.voostack.com/c/cloud-infrastructure)
- **Latest version:** 0.1.0
- **License:** MIT
- **Upstream author:** [hlsitechio](https://github.com/hlsitechio)
- **Source:** https://github.com/hlsitechio/claude-skills-security/tree/main/appsec-stack-pack/hono-security

## Install

```sh
agentstack add skill-hlsitechio-claude-skills-security-hono-security
```

Requires the [AgentStack CLI](https://agentstack.voostack.com/docs/cli). Works with Claude Code, Cursor, and any MCP-compatible agent.

## About

# Hono Security Audit

Audit Hono apps. Hono is a small, fast framework targeting Workers/Bun/Deno/Node/Lambda — each runtime has its own security context.

## When this skill applies

- Reviewing Hono route handlers and middleware
- Auditing JWT and auth helpers
- Reviewing env bindings across runtimes
- Checking CORS, helmet-equivalent setup
- Confirming runtime-specific concerns (Workers, Lambda, etc.)

## Workflow

Follow `../_shared/audit-workflow.md`.

### Phase 1: Stack detection

```bash
grep -E '"hono":' package.json
grep -nE 'import.*hono' src/ | head -5
# Detect runtime
grep -E '"wrangler"|"@cloudflare/workers-types"' package.json && echo "Cloudflare Workers"
grep -E '"@types/bun"|"bun"' package.json && echo "Bun"
grep -E '"@types/aws-lambda"' package.json && echo "AWS Lambda"
```

### Phase 2: Inventory

```bash
# Routes and handlers
grep -rn 'app\.\(get\|post\|put\|delete\|use\)' src/ | head -50

# Middleware imports
grep -rn 'from .hono/(jwt|cors|csrf|secure-headers|logger|cache)' src/

# Env access
grep -rn 'c\.env\.' src/

# Variables (per-request context)
grep -rn 'c\.set\|c\.var' src/
```

### Phase 3: Detection — the checks

#### Middleware setup

- **HNO-MW-1** `secureHeaders()` middleware from `hono/secure-headers` applied — Hono's equivalent of helmet.
- **HNO-MW-2** `cors()` from `hono/cors` configured with specific `origin` allowlist, not `*` for credentialed requests.
- **HNO-MW-3** `logger()` middleware doesn't log sensitive headers/bodies.
- **HNO-MW-4** Order: secureHeaders → cors → auth → routes.

```ts
import { Hono } from 'hono';
import { secureHeaders } from 'hono/secure-headers';
import { cors } from 'hono/cors';
import { jwt } from 'hono/jwt';

const app = new Hono();

app.use('*', secureHeaders());
app.use('*', cors({
  origin: ['https://app.yourorg.com'],
  credentials: true,
}));

// Auth on /api/* except /api/auth/*
app.use('/api/*', async (c, next) => {
  if (c.req.path.startsWith('/api/auth/')) return next();
  return jwt({ secret: c.env.JWT_SECRET })(c, next);
});
```

#### JWT middleware

- **HNO-JWT-1** `c.env.JWT_SECRET` (or per-runtime equivalent) used, not hardcoded.
- **HNO-JWT-2** Algorithm specified (`alg: 'HS256'` or `'RS256'`); never `none`.
- **HNO-JWT-3** `c.get('jwtPayload')` accessed in downstream handlers; trust scoped to verified claims only.
- **HNO-JWT-4** Token expiry validated by the middleware (Hono's JWT helper does this by default; verify).

#### Environment bindings (Cloudflare Workers)

```ts
type Bindings = {
  JWT_SECRET: string;
  DATABASE_URL: string;
  KV: KVNamespace;
  R2: R2Bucket;
};

const app = new Hono();

app.get('/api/data', (c) => {
  const value = c.env.JWT_SECRET;   // ← typed; server-side only
});
```

- **HNO-ENV-1** Bindings types declared so `c.env.X` is type-checked.
- **HNO-ENV-2** Secrets bound via `wrangler secret put`, not in `wrangler.toml` plaintext.
- **HNO-ENV-3** See `cloudflare-workers-security` for binding-level concerns.

#### Validators

- **HNO-VAL-1** Input validated via `@hono/zod-validator` or similar:
  ```ts
  import { zValidator } from '@hono/zod-validator';
  import { z } from 'zod';
  
  const schema = z.object({ name: z.string().min(1).max(100), email: z.string().email() });
  
  app.post('/users', zValidator('json', schema), async (c) => {
    const data = c.req.valid('json');   // validated, typed
    // ...
  });
  ```
- **HNO-VAL-2** Path params and query strings also validated when used.

#### CSRF

- **HNO-CSRF-1** If cookies are used for auth: `csrf()` middleware from `hono/csrf` applied. Hono's CSRF protection uses origin check by default.
- **HNO-CSRF-2** For pure Bearer token APIs (no auth cookies), CSRF not needed.

#### Cookie handling

- **HNO-CK-1** Cookies set via `setCookie(c, name, value, { httpOnly: true, secure: true, sameSite: 'Lax' })` — secure defaults explicit.
- **HNO-CK-2** Cookie reading via Hono's `getCookie(c)` — handles parsing safely.

#### Error handling

- **HNO-ERR-1** `app.onError((err, c) => ...)` handler returns generic errors in production; logs detail server-side.
- **HNO-ERR-2** `app.notFound((c) => ...)` returns minimal info.

#### Runtime-specific

**Cloudflare Workers:**
- See `cloudflare-workers-security` for binding/KV/Durable Object concerns.

**Node:**
- See `nodejs-express-security` for body parser limits, prototype pollution, etc.
- Hono on Node uses `@hono/node-server` — confirm version current.

**Bun:**
- Bun runtime concerns: keep Bun version current; verify `bun.lockb` reflects intended packages.

**Lambda:**
- See `aws-lambda-security` for cold start, env, IAM concerns.

#### Dependencies

- **HNO-DEP-1** Hono version current (4.x line).
- **HNO-DEP-2** `@hono/*` companion packages match Hono major.

### Phase 4: Triage

Critical: missing auth on routes that should be protected; secrets in `wrangler.toml`; JWT verification accepting `none`; CORS open with credentials.

### Phase 5: Report

Use `../_shared/findings-schema.md`. Prefix IDs with `HNO-`.

## Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

- **Author:** [hlsitechio](https://github.com/hlsitechio)
- **Source:** [hlsitechio/claude-skills-security](https://github.com/hlsitechio/claude-skills-security)
- **License:** MIT

Install and usage instructions live in the source repository linked above.

## Pricing

- **Free** — Free

## Security capabilities

Automated source analysis of v0.1.0 — what this tool can access:

- **Network access:** no
- **Filesystem access:** no
- **Shell / process execution:** no
- **Environment & secrets:** yes
- **Dynamic code execution:** no

*"Yes" means the capability is present in the source — more access means more to trust, not that it is unsafe.*


## Versions

- **0.1.0** — security scan: passed — Imported from the upstream source.

## Links

- Listing page: https://agentstack.voostack.com/l/skill-hlsitechio-claude-skills-security-hono-security
- Seller: https://agentstack.voostack.com/s/hlsitechio
- Browse the marketplace: https://agentstack.voostack.com/browse

---
Listed on AgentStack — the marketplace for AI agent skills and MCP servers. Every listing is security-reviewed. Creators keep 70%.