Dear Javier,
thank you for your very useful reply.
You wrote that these hardening flags are individual for all packages. So is it possible to see which packages have which build flags enabled? (via the new package tracker or the package search).
It's not practicable to install each package and test it with a script or look in the build file.
And for the kernel hardening: -fstack-protector and runtime memory allocation validation are not exactly described in the https://wiki.debian.org/Hardening page.
I'd like to express with the wiki page (the Security Features Matrix) that it would be nice to see all information at one point. Probably it would be good to include such a Matrix in the official documentation or the release notes. I know that the Debian project is working heavily on security, but the documentation of this process is not very good.
Yours,
Oliver