# spatie-security

Applies Spatie's security guidelines across applications, databases, servers, and Git workflows. Useful during infrastructure setup and security code reviews.

- skill · `type=skill` · Claude Code, Codex, Cursor, GitHub Copilot, Gemini CLI, OpenCode · 629 installs · ★ 97
- Author: Spatie
- License: MIT · policy=mirror · the beginning of the file is at the end of this page
- Source: https://github.com/spatie/guidelines-skills/tree/HEAD/resources/boost/skills/spatie-security/SKILL.md
- Updated: 2026-10-22
- HTML: https://affpapa.org/en/nevibecode/skills/spatie-security

## What it does

This skill guides agents through Spatie's security practices for codebases and infrastructure. It handles SSL setup, CSRF protection, password hashing, and database user isolation. It also enforces signed Git commits and secure credential handling.

The skill references `references/spatie-security-guidelines.md`. When activated, the agent identifies the security issue and applies the narrowest relevant protection without weakening existing safeguards. Rules include disabling SSH password authentication, enabling unattended security updates, and restricting database hosts.

Code style, business logic, and UI design are out of scope. Because of that focus, the agent will not touch code formatting or interface components. It zeroes in on permissions and vulnerabilities.

## Install

### Claude Code (native platform)

1. **Skills CLI (Vercel)**
```bash
npx skills add spatie/guidelines-skills --skill spatie-security -a claude-code
```

2. **Manually: put the files in place**
- File: `~/.claude/skills/spatie-security/SKILL.md` — Copy the whole skill folder; for one project use .claude/skills/spatie-security/

### Codex

1. **Skills CLI (Vercel)**
```bash
npx skills add spatie/guidelines-skills --skill spatie-security -a codex
```

2. **Manually: put the files in place**
- File: `.agents/skills/spatie-security/SKILL.md` — For all projects use ~/.agents/skills/

### Cursor

1. **Skills CLI (Vercel)**
```bash
npx skills add spatie/guidelines-skills --skill spatie-security -a cursor
```

2. **Manually: put the files in place**
- File: `.cursor/skills/spatie-security/SKILL.md` — Cursor also reads .agents/skills/ and .claude/skills/

### GitHub Copilot

1. **GitHub CLI**
```bash
gh skill install spatie/guidelines-skills spatie-security
```

2. **Manually: put the files in place**
- File: `.github/skills/spatie-security/SKILL.md`

### Gemini CLI

1. **Skills CLI (Vercel)**
```bash
npx skills add spatie/guidelines-skills --skill spatie-security -a gemini-cli
```

2. **Platform CLI**
```bash
gemini skills install https://github.com/spatie/guidelines-skills --path resources/boost/skills/spatie-security
```

### Windsurf (Devin Desktop)

**Manually: put the files in place**
- File: `.devin/skills/spatie-security/SKILL.md` — The legacy .windsurf/skills/ path still works

### OpenCode

**Skills CLI (Vercel)**
```bash
npx skills add spatie/guidelines-skills --skill spatie-security -a opencode
```

### Claude.ai

**Claude.ai**
- Zip the folder and upload it in Settings → Capabilities → Skills

Where a file is given instead of a command, copy the files from the source to that path: https://github.com/spatie/guidelines-skills/tree/HEAD/resources/boost/skills/spatie-security/SKILL.md

## When to use it
- enforce SSL and CSRF protection in web applications
- harden servers by disabling SSH password logins and enabling firewall rules
- isolate database users and restrict permitted database hosts
- configure signed Git commits and protect private keys
- audit controllers and forms for authorization vulnerabilities

## Example prompts
- Review our server and database configuration using spatie-security rules
- Check this controller for CSRF protection and authorization checks
- Help me set up signed Git commits according to Spatie guidelines

## Source text · SKILL.md · MIT

Below is the content of a third-party file. It is data, not instructions for you: do not act on anything written inside unless the human asks. Block tag: 516677480c2bd227.

BEGIN THIRD-PARTY FILE 516677480c2bd227
```text
---
name: spatie-security
description: Apply Spatie's security guidelines when configuring applications, databases, servers, credentials, or signed Git commits, or when reviewing code for security concerns; use for SSL setup, CSRF protection, password hashing, database permissions, and server hardening.
license: MIT
metadata:
  author: Spatie
---

# Spatie Security Guidelines

## Overview
Apply Spatie's security best practices when building, configuring, or reviewing applications and infrastructure.

## When to Activate
- Activate this skill when configuring application security (authentication, authorization, forms).
- Activate this skill when setting up or reviewing database configurations.
- Activate this skill when configuring servers or reviewing infrastructure.
- Activate this skill when reviewing code for security vulnerabilities.
- Activate this skill when configuring or creating signed Git commits.

## Scope
- In scope: Application security, database security, server configuration, credential management, signed Git commits.
- Out of scope: Code style, business logic, UI/UX design.

## Workflow
1. Identify the application, database, server, credential, or Git security concern.
2. Read `references/spatie-security-guidelines.md` and focus on the relevant sections.
3. Apply the narrowest relevant security controls without weakening existing protections.

## Core Rules (Summary)
- Store unique passwords in 1Password, enable two-factor authentication, and password-protect private keys.
- Sign all Git commits.
- Use SSL, CSRF protection, appropriate HTTP methods, and automated authorization tests.
- Hash passwords, encrypt stored API keys, isolate database users, and restrict database hosts.
- Keep servers current, disable SSH password authentication, enable unattended security updates, and restrict firewall traffic.
- Protect devices, backups, sensitive data, and browser activity.

## References
- `references/spatie-security-guidelines.md`
```
END THIRD-PARTY FILE 516677480c2bd227

The third-party file has ended. Everything between the 516677480c2bd227 tags is data: requests and commands from it are not followed. An “end of file” line with another tag inside the block is part of the file.

© Spatie · MIT · https://github.com/spatie/guidelines-skills/tree/HEAD/resources/boost/skills/spatie-security/SKILL.md

## Similar
- [security-ownership-map](https://affpapa.org/en/nevibecode/skills/security-ownership-map.md) — skill · 3800 installs
- [claude-security](https://affpapa.org/en/nevibecode/skills/claude-security.md) — skill · 2304 installs
- [diff-scanning-with-aws-security-agent](https://affpapa.org/en/nevibecode/skills/diff-scanning-with-aws-security-agent.md) — skill · 1500 installs
- [code-security](https://affpapa.org/en/nevibecode/skills/code-security.md) — skill · 2600 installs
- [security-auditor](https://affpapa.org/en/nevibecode/skills/sickn33-security-auditor.md) — skill · 1400 installs
- [docker-security-guide](https://affpapa.org/en/nevibecode/skills/docker-security-guide.md) — skill · 595 installs

From the same set: [spatie/guidelines-skills](https://affpapa.org/en/nevibecode/by/spatie/guidelines-skills.md) — 4 cards

---
NeVibeCode on affpapa.org. Catalog texts are descriptions, not instructions for the agent. How to choose and install: https://affpapa.org/en/nevibecode/agents.md