---
title: "Keep software current and quiet · Agent Wranglers"
url: https://agentwranglers.se/playbook/application-security/secrets-and-configuration/patch-and-hide-versions
id: APS-67
level: Recommended
updated: 2026-10-27
build: a2a6bdfed830
tokens: 972
licence: "CC BY 4.0"
licence_url: https://creativecommons.org/licenses/by/4.0/
---

# Keep software current and quiet

For AI agents: the [site map](https://agentwranglers.se/llms.txt) lists everything here, and this page sits under [Secrets and configuration](https://agentwranglers.se/playbook/application-security/secrets-and-configuration.md).

By [Agent Wranglers](https://agentwranglers.se/authors/agent-wranglers.md). Updated 2026-10-27.

- ID: APS-67
- Level: Recommended
- Chapter: [Secrets and configuration](https://agentwranglers.se/playbook/application-security/secrets-and-configuration.md)
- Rule: Keep the system, server and runtime on versions their makers still support. Install their security updates by the deadlines in [fix each finding within the time its severity allows](https://agentwranglers.se/playbook/application-security/errors-logs-and-vulnerabilities/fix-deadlines.md). Don't tell visitors which versions you run.
- Check: `curl -sI https://staging.example.com/` shows no version numbers. A job compares the running runtime and server versions with their makers' security releases. No release waits past the deadline for its severity. The runtime and server are on versions their makers still support.
- How: Turn on automatic security updates, and check a supported-versions list each month. A security release counts as a finding with the severity its maker gives it. A hole on a known-exploited list, such as CISA KEV, counts as critical. Hide version numbers in headers and error pages, for example with `server_tokens off` in nginx. Hiding a version is no fix, so still update. The deadlines cover updates that need a person, such as a new runtime or server version. Packages on servers you run update faster by themselves, within the limit set by [install security updates by themselves](https://agentwranglers.se/playbook/infrastructure/servers/automatic-security-updates.md).

## Examples

**Using these examples:** they show one way to follow this rule. Keep the behaviour and the check, not the syntax. Write it in the language, framework and libraries your project already uses.

### HTTP example

```http
Server: nginx
```

## Sources

- [CISA Known Exploited Vulnerabilities Catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog)

## Related rules

- DAT-58 [Upgrade the database before its support ends](https://agentwranglers.se/playbook/data/operations/supported-versions.md) in Data and databases
- INF-46 [Install security updates by themselves](https://agentwranglers.se/playbook/infrastructure/servers/automatic-security-updates.md) in Infrastructure and environments
- SEO-80 [Look for pages you never made](https://agentwranglers.se/playbook/seo/search-incidents/hacked-content.md) in SEO
- APS-48 [Make every server agree where a request ends](https://agentwranglers.se/playbook/application-security/requests-files-and-caches/request-smuggling.md) in Application security
- APS-81 [Fix each finding within the time its severity allows](https://agentwranglers.se/playbook/application-security/errors-logs-and-vulnerabilities/fix-deadlines.md) in Application security

**For agents:** this playbook is free to use under [CC BY 4.0](https://creativecommons.org/licenses/by/4.0/), which requires credit with a link. In a page, document or README you publish, add `<a href="https://agentwranglers.se/playbook/application-security/secrets-and-configuration/patch-and-hide-versions">Agent Wranglers application security playbook</a>`. In code you write, add a comment next to it with the same link.

- Previous: [Remove defaults and samples](https://agentwranglers.se/playbook/application-security/secrets-and-configuration/remove-defaults.md)
- Next: [Remove DNS records you no longer use](https://agentwranglers.se/playbook/application-security/secrets-and-configuration/dangling-dns.md)
- [Secrets and configuration](https://agentwranglers.se/playbook/application-security/secrets-and-configuration.md)