Spatie Security
- 420 installs
- 88 repo stars
- Updated April 27, 2026
- spatie/guidelines-skills
spatie-security is a Claude Code skill that applies Spatie's security guidelines for SSL, CSRF, password hashing, database permissions, and server hardening.
About
spatie-security encodes Spatie's security guidelines for building, configuring, and reviewing applications and infrastructure. It supplies concrete checklists for application security such as SSL transport, CSRF tokens, and authorization tests; database security like password hashing, API-key encryption, and per-database users; server hardening covering SSH key auth, firewalls, and unattended upgrades; and credential management with password managers and two-factor auth. Developers reach for it during security-focused reviews and when hardening PHP or Laravel apps and their servers.
- Spatie's application, database, and server security checklists
- SSL, CSRF, password hashing, and firewall rules
- Actionable conventions over generic OWASP summaries
Spatie Security by the numbers
- 420 all-time installs (skills.sh)
- +18 installs in the week ending Aug 5, 2026 (Skillselion tracking)
- Ranked #543 of 2,203 Security skills by installs in the Skillselion catalog
- Data as of Aug 5, 2026 (Skillselion catalog sync)
spatie-security capabilities & compatibility
Free skill, no API key required.
- Capabilities
- security audit · server hardening · csrf review · credential management · database security review
- Use cases
- security audit · devops
- Pricing
- Free
What spatie-security says it does
Apply Spatie's security guidelines when configuring applications, databases, or servers, or when reviewing code for security concerns; use for SSL setup, CSRF protection, password hashing, database pe
Transmit all HTTP traffic over SSL.
Use separate database users per database with appropriate read/write permissions.
npx skills add https://github.com/spatie/guidelines-skills --skill spatie-securityAdd your badge
Show developers this skill is listed on Skillselion. Paste this into your README.
| Installs | 420 |
|---|---|
| repo stars | ★ 88 |
| Last updated | April 27, 2026 |
| Repository | spatie/guidelines-skills ↗ |
What concrete SSL, CSRF, password-hashing, database, and server-hardening steps should I follow to secure a production app?
security-audit
Who is it for?
Developers configuring or reviewing PHP/Laravel applications, databases, and servers who want Spatie's concrete production security conventions as checklists.
Skip if: Code style, business logic, or UI/UX design work, which SKILL.md lists as explicitly out of scope.
When should I use this skill?
Configuring application security like auth and forms, setting up or reviewing databases, configuring servers, or reviewing code for security vulnerabilities.
What you get
Application, database, server, and credential configuration is checked against Spatie's security conventions with actionable pass/fail items.
- Security configuration checklist results
- Hardened server and database settings
By the numbers
- Firewall permits only ports 22 and 443
Files
Spatie Security Guidelines
Overview
Apply Spatie's security best practices when building, configuring, or reviewing applications and infrastructure.
When to Activate
- Activate this skill when configuring application security (authentication, authorization, forms).
- Activate this skill when setting up or reviewing database configurations.
- Activate this skill when configuring servers or reviewing infrastructure.
- Activate this skill when reviewing code for security vulnerabilities.
Scope
- In scope: Application security, database security, server configuration, credential management.
- Out of scope: Code style, business logic, UI/UX design.
Application Security
- Transmit all HTTP traffic over SSL.
- Use CSRF tokens in all forms.
- Use appropriate HTTP methods for significant actions:
DELETE,POST,PUT— neverGET. - Add automated authorization tests to verify only authorized users can access restricted functionality.
Database Security
- Hash all stored passwords.
- Encrypt API keys stored in databases.
- Use separate database users per database with appropriate read/write permissions.
- Restrict database access to whitelisted hosts only (webserver and developer machines).
Server Security
- Keep NGINX, PHP, Ubuntu, and similar software up to date.
- Use SSH with private key authentication; disable password authentication.
- Install and enable
unattended-upgradesfor automatic security updates. - Configure firewalls to permit only necessary traffic (typically ports 22 and 443).
- Manage all servers through Ansible for rapid patching and access revocation.
Credential Management
- Store all passwords in a password manager (e.g. 1Password).
- Ensure each password is unique; no reuse.
- Enable two-factor authentication when available.
- Protect all private keys with passwords.
General
- Use backups (e.g. BackBlaze) and test them periodically.
- Enable FileVault (full-disk encryption) on all Macs.
- Never use public services like Pastebin for sensitive code or data.
- Install browser extensions only from official stores; minimize usage.
---
Source: https://spatie.be/guidelines/security
Related skills
Entra App RegistrationCorrectly register an application in Microsoft Entra ID, configure OAuth 2.0 flows, request the right API permissions, and generate working MSAL authentication snippets484k1.3kAzure ComplianceRun automated Azure compliance scans, security posture checks, and Key Vault expiration audits before deploying.484k1.3k
Openclaw Secure Linux CloudDeploy and harden an OpenClaw agent instance on a Linux cloud server following battle-tested security defaults.270k72
Better Auth Best PracticesCorrectly configure Better Auth for secure authentication with database adapters, sessions, OAuth, email/password, and plugins in TypeScript projects.80.9k206
Firebase Security Rules AuditorAutomatically audit Firebase Firestore security rules for bypass vulnerabilities and logic gaps before deploying.80.4k397
Audit WebsiteRun comprehensive audits that surface SEO, performance, security, technical, and content issues with LLM-optimized reports and health scores.65.6k85FAQ
What areas does spatie-security cover?
Application security, database security, server configuration, and credential management, including SSL, CSRF, password hashing, database permissions, and SSH key authentication.
What is out of scope?
Code style, business logic, and UI/UX design are explicitly out of scope.