mcpField
S
spatie-security

spatie-security

github.com/spatieSecurity97645 installsUpdated 6d ago
Repository

About spatie-security

A security skill for applying Spatie’s practices to application, database, server, credential, and Git security. It guides reviews and configuration work through a reference document and recommends narrowly scoped controls.

Key features

  1. 01Application security guidance
  2. 02Database and server configuration checks
  3. 03Credential and private-key protection
  4. 04Signed Git commits
  5. 05Security vulnerability reviews

Use cases

  1. 01Configuring authentication and authorization
  2. 02Reviewing database or server security
  3. 03Assessing code for vulnerabilities

Install

Copy the command and run it in a terminal.

$npx skills add https://github.com/spatie/guidelines-skills --skill spatie-security

After installing, type/spatie-securityin Claude Code to confirm it loaded.

Bundled filesreferences/spatie-security-guidelines.md

Details

From the project README

Spatie Security Guidelines

Overview

Apply Spatie's security best practices when building, configuring, or reviewing applications and infrastructure.

When to Activate

  • Activate this skill when configuring application security (authentication, authorization, forms).
  • Activate this skill when setting up or reviewing database configurations.
  • Activate this skill when configuring servers or reviewing infrastructure.
  • Activate this skill when reviewing code for security vulnerabilities.
  • Activate this skill when configuring or creating signed Git commits.

Scope

  • In scope: Application security, database security, server configuration, credential management, signed Git commits.
  • Out of scope: Code style, business logic, UI/UX design.

Workflow

  1. Identify the application, database, server, credential, or Git security concern.
  2. Read references/spatie-security-guidelines.md and focus on the relevant sections.
  3. Apply the narrowest relevant security controls without weakening existing protections.

Core Rules (Summary)

  • Store unique passwords in 1Password, enable two-factor authentication, and password-protect private keys.
  • Sign all Git commits.
  • Use SSL, CSRF protection, appropriate HTTP methods, and automated authorization tests.
  • Hash passwords, encrypt stored API keys, isolate database users, and restrict database hosts.
  • Keep servers current, disable SSH password authentication, enable unattended security updates, and restrict firewall traffic.
  • Protect devices, backups, sensitive data, and browser activity.

References

  • references/spatie-security-guidelines.md

Comments

Markdown supported