---
id: hardening-flags
track: coding
version: 0.1.2
label: blocks
keyword: block
where: write turn-end
sha256: 28d436cb1ea5dd94330617eff3475a453ac113337b59ef10fa13d06d973d1a1f
source: https://github.com/open-coder-ai/chock-catalog/tree/1e60d211c1bb767152c6ab0167932da06ab3a10f/base/hardening-flags
catalog_ref: 1e60d211c1bb767152c6ab0167932da06ab3a10f
---

# Block Weakened Build Hardening

hardening-flags · version 0.1.2

Blocks — Blocks on an agent's file writes and at turn end. Chock adds friction. It is not a security boundary. 

In a git repo: at commit (Chock refuses the commit, locally and in CI.)



## What it does

Blocks added settings that weaken compiler, linker, Rust or kernel hardening, in CMake, Make, meson, configure.ac, Cargo, build.rs, Go release scripts, Dockerfiles and kernel config: no stack protector, FORTIFY_SOURCE off, non-PIE, execstack, norelro, CET off, kernel KASLR/RWX off. Asks on Rust release overflow-checks off, /dev/mem. Not MSVC, sysctl or container settings; misses environment flags, generated files. Runs: commit, agent write, turn's end, CI. Waiver: 'pragma: allowlist hardening-flag'.

## Its label on each agent

- Claude Code (tested): Blocks — Blocks on an agent's file writes and at turn end. Builder: /coding/builder/#client=claude-code&p=hardening-flags
- Cursor (tested): Blocks — Blocks on an agent's file writes and at turn end. Where its description says it asks, it refuses at both points, because this client cannot prompt at either point. Builder: /coding/builder/#client=cursor&p=hardening-flags
- Codex (tested): Blocks — Blocks on an agent's file writes and at turn end. Where its description says it asks, it refuses at both points, because this client cannot prompt at either point. If the hook errors, the action goes through (not witnessed; the vendor's row is only partly live-run). Builder: /coding/builder/#client=codex&p=hardening-flags
- GitHub Copilot (tested): Blocks — Blocks at turn end only. It does not check a file write when it happens. Where its description says it asks, it refuses at turn end, because this client cannot prompt there. If the hook errors, the action goes through (not witnessed; the vendor's row is only partly live-run). Builder: /coding/builder/#client=copilot&p=hardening-flags
- Devin (tested): Blocks — Blocks at turn end only. It does not check a file write when it happens. Where its description says it asks, it refuses at turn end, because this client cannot prompt there. If the hook errors, the action goes through (vendor docs only, not witnessed). Builder: /coding/builder/#client=devin&p=hardening-flags
- Grok (tested): Not graded yet for Grok. Builder: /coding/builder/#client=grok&p=hardening-flags
- goose (tested): Not graded yet for goose. Builder: /coding/builder/#client=goose&p=hardening-flags
- Antigravity (tested): Not graded yet for Antigravity. Builder: /coding/builder/#client=antigravity&p=hardening-flags
- OpenHands (untested): Not graded yet for OpenHands. Builder: /coding/builder/#client=openhands&p=hardening-flags
- Kimi Code (untested): Not graded yet for Kimi Code. Builder: /coding/builder/#client=kimi-code&p=hardening-flags
- Factory Droid (untested): Not graded yet for Factory Droid. Builder: /coding/builder/#client=factory-droid&p=hardening-flags

## What it misses

This policy does not state what it misses.

## Examples

- Refused: A CMake change adds -fno-stack-protector to target_compile_options.
- Allowed: A change adds -fstack-protector-strong.

## Latest change

0.1.2 · 2026-10-27 — Title wording only (IR-F40): "Hardening Flags" is now "Block Weakened Build Hardening". The id, guard and tests are unchanged.

## Provenance

- Tested by 36 of 36 cases run automatically
- SHA-256: `28d436cb1ea5dd94330617eff3475a453ac113337b59ef10fa13d06d973d1a1f`
- Catalog commit: https://github.com/open-coder-ai/chock-catalog/commit/1e60d211c1bb767152c6ab0167932da06ab3a10f
- Source: https://github.com/open-coder-ai/chock-catalog/tree/1e60d211c1bb767152c6ab0167932da06ab3a10f/base/hardening-flags (catalog path `base/hardening-flags`)
- Presets: Code hardening
- JSON: `/api/coding/policies/hardening-flags.json`
- Report a problem: https://chock.sh/report/?policy=hardening-flags&version=0.1.2&page=%2Fcoding%2Fpolicies%2Fhardening-flags%2F