Quarkus Security

Covers the essentials for locking down Quarkus apps: JWT and OIDC authentication, role-based access control with @RolesAllowed, input validation with Bean Validation, and SQL injection prevention using Panache's parameterized queries. Includes practical examples of custom auth filters, programmatic security checks, password hashing with Bcrypt, and secrets management via environment variables or Vault. The CORS configuration and custom validator samples are actually useful. Activate this when you're adding authentication to endpoints, implementing authorization logic, or hardening an existing Quarkus service. It's surprisingly thorough on the fundamentals without getting academic about threat modeling.

skills.sh installs: 1.6K
GitHub stars: 229.1K
last updated: Jul 14, 2026

View on GitHub

Install

$ npx -y skills add affaan-m/everything-claude-code --skill quarkus-security --agent claude-code

Installs into .claude/skills of the current project.

Files

Quarkus Security Review

Best practices for securing Quarkus applications with authentication, authorization, and input validation.

When to Activate

Adding authentication (JWT, OIDC, Basic Auth)
Implementing authorization with @RolesAllowed or SecurityIdentity
Validating user input (Bean Validation, custom validators)
Configuring CORS or security headers
Managing secrets (Vault, environment variables, config sources)
Adding rate limiting or brute-force protection
Scanning dependencies for CVEs
Working with MicroProfile JWT or SmallRye JWT

Authentication

JWT Authentication

// Resource protected with JWT
@Path("/api/protected")
@Authenticated
public class ProtectedResource {

  @Inject
  JsonWebToken jwt;

  @Inject
  SecurityIdentity securityIdentity;

  @GET
  public Response getData() {
    String username = jwt.getName();
    Set<String> roles = jwt.getGroups();
    return Response.ok(Map.of(
        "username", username,
        "roles", roles,
        "principal", securityIdentity.getPrincipal().getName()
    )).build();
  }
}

SKILL.md on GitHub