Spatie Security
This brings Spatie's battle-tested security checklist into your workflow when you're configuring apps, reviewing code, or hardening servers. It covers the fundamentals that are easy to forget under deadline pressure: CSRF tokens in forms, SSL everywhere, proper HTTP verbs for destructive actions, hashed passwords, encrypted API keys, SSH key-only authentication, and firewall rules that actually lock things down. The guidance is opinionated in a good way, like insisting on separate database users per database and managing servers through Ansible for quick access revocation. It won't teach you security from scratch, but it's a solid reference for teams who want to align on practical standards without writing their own security policy doc.
- skills.sh installs
- 678
- GitHub stars
- 98
- last updated
- Aug 21, 2026
Install
$ npx -y skills add spatie/guidelines-skills --skill spatie-security --agent claude-codeInstalls into .claude/skills of the current project.
Files
Spatie Security Guidelines
Overview
Apply Spatie's security best practices when building, configuring, or reviewing applications and infrastructure.
When to Activate
- Activate this skill when configuring application security (authentication, authorization, forms).
- Activate this skill when setting up or reviewing database configurations.
- Activate this skill when configuring servers or reviewing infrastructure.
- Activate this skill when reviewing code for security vulnerabilities.
- Activate this skill when configuring or creating signed Git commits.
Scope
- In scope: Application security, database security, server configuration, credential management, signed Git commits.
- Out of scope: Code style, business logic, UI/UX design.
Workflow
- Identify the application, database, server, credential, or Git security concern.
- Read
references/spatie-security-guidelines.mdand focus on the relevant sections. - Apply the narrowest relevant security controls without weakening existing protections.
Sponsors
Agent CaffeineSponsoredClose your lid, come back to finished work
SnugSponsoredThe clipboard manager for the AI eraPromote your product hereReach 125k+ visitors monthly
WaxSponsoredBlock anything with supervision, without erasing your iPhonePromote your product hereReach 125k+ visitors monthly
knobsSponsoredSee your site on any phone, any day, in any languageDetails
- Repository
- github.com/spatie/guidelines-skills
- Categories
- Backend & APIs, Security, Databases
- First seen
- Jun 3, 2026
More from spatie/guidelines-skills
All 4Recommended
More Backend & APIs
fhir-developer-skillanthropics/healthcareFHIR API development guide for building healthcare endpoints. Use when: (1) Creating FHIR REST endpoints (Patient, Observation, Encounter, Condition, Medication672skills.sh installs
nestjs-expertdavila7/claude-code-templatesNest.js framework expert specializing in module architecture, dependency injection, middleware, guards, interceptors, testing with Jest/Supertest, TypeORM/Mongo672skills.sh installs
unbrowseunbrowse-ai/unbrowseThe action engine of the internet. Unbrowse is the open-source action layer for AI agents: it learns a site's internal API routes from real browsing, then repla669skills.sh installs
ruby-rails-applicationaj-geddes/useful-ai-promptsDevelop Ruby on Rails applications with models, controllers, views, Active Record ORM, authentication, and RESTful routes. Use when building Rails applications,660skills.sh installs
pp-archive-ismvanhorn/printing-press-libraryUse this skill whenever the user wants to archive a URL, bypass a paywall, look up an existing archive, view a cached version of a webpage, pull article text fr651skills.sh installs
feishu-cli-bitableriba2534/feishu-cli飞书多维表格（Bitable/Base）操作。底层使用 base/v3 新 API，支持视图完整配置写入、 记录 upsert、记录批量获取、记录附件上传下载、记录修改历史、角色 CRUD + 协作者增删、 多维表格本体重命名/高级权限开关、数据聚合查询、 仪表盘 + 仪表盘块 CRUD、表单 + 表单问题 CRUD、648skills.sh installs