Hardening a Production Web App: A Practical Security Audit

I asked Claude Code to run a full security audit on this site's infrastructure and code, then fix what it found. Here's the exact playbook — real commands, explained — including a Docker-vs-firewall bug that had nothing to do with this app's own code.