Quarkus Security

This walks you through the practical side of locking down Quarkus apps: JWT and OIDC authentication, role-based access with @RolesAllowed, Bean Validation for input sanitization, and proper secrets management with Vault or environment variables. It covers the stuff you'll actually hit when building a production service: preventing SQL injection with Panache's parameterized queries, hashing passwords with Bcrypt, configuring CORS properly, and doing ownership checks beyond simple role checking. The examples are straightforward and show both the wrong way and the right way, which honestly saves time when you're trying to remember whether you need to validate at the DTO level or the entity level. Good reference when you're adding auth to existing endpoints or reviewing security before a release.

skills.sh installs: 5.4K
GitHub stars: 300.3K
last updated: Aug 21, 2026

View on GitHub

Install

$ npx -y skills add affaan-m/ecc --skill quarkus-security --agent claude-code

Installs into .claude/skills of the current project.

Files

Quarkus Security Review

Best practices for securing Quarkus applications with authentication, authorization, and input validation.

When to Activate

Adding authentication (JWT, OIDC, Basic Auth)
Implementing authorization with @RolesAllowed or SecurityIdentity
Validating user input (Bean Validation, custom validators)
Configuring CORS or security headers
Managing secrets (Vault, environment variables, config sources)
Adding rate limiting or brute-force protection
Scanning dependencies for CVEs
Working with MicroProfile JWT or SmallRye JWT

Authentication

JWT Authentication

// Resource protected with JWT
@Path("/api/protected")
@Authenticated
public class ProtectedResource {

  @Inject
  JsonWebToken jwt;

  @Inject
  SecurityIdentity securityIdentity;

  @GET
  public Response getData() {
    String username = jwt.getName();
    Set<String> roles = jwt.getGroups();
    return Response.ok(Map.of(
        "username", username,
        "roles", roles,
        "principal", securityIdentity.getPrincipal().getName()
    )).build();
  }
}

SKILL.md on GitHub