spatie-security

---
name: spatie-security
description: Use for secure application, database, server, credential, TLS, CSRF, password, or access-control configuration and review.
license: MIT
metadata:
  author: Spatie
---

# Spatie Security Guidelines

## Overview

Apply Spatie's security best practices when building, configuring, or reviewing applications and infrastructure.

## When to Activate

- Activate this skill when configuring application security (authentication, authorization, forms).
- Activate this skill when setting up or reviewing database configurations.
- Activate this skill when configuring servers or reviewing infrastructure.
- Activate this skill when reviewing code for security vulnerabilities.

## Scope

- In scope: Application security, database security, server configuration, credential management.
- Out of scope: Code style, business logic, UI/UX design.

## Application Security

- Transmit all HTTP traffic over SSL.
- Use CSRF tokens in all forms.
- Use appropriate HTTP methods for significant actions: `DELETE`, `POST`, `PUT` — never `GET`.
- Add automated authorization tests to verify only authorized users can access restricted functionality.

## Database Security

- Hash all stored passwords.
- Encrypt API keys stored in databases.
- Use separate database users per database with appropriate read/write permissions.
- Restrict database access to whitelisted hosts only (webserver and developer machines).

## Server Security

- Keep NGINX, PHP, Ubuntu, and similar software up to date.
- Use SSH with private key authentication; disable password authentication.
- Install and enable `unattended-upgrades` for automatic security updates.
- Configure firewalls to permit only necessary traffic (typically ports 22 and 443).
- Manage all servers through Ansible for rapid patching and access revocation.

## Credential Management

- Store all passwords in a password manager (e.g. 1Password).
- Ensure each password is unique; no reuse.
- Enable two-factor authentication when available.
- Protect all private keys with passwords.

## General

- Use backups (e.g. BackBlaze) and test them periodically.
- Enable FileVault (full-disk encryption) on all Macs.
- Never use public services like Pastebin for sensitive code or data.
- Install browser extensions only from official stores; minimize usage.

---

Source: <https://spatie.be/guidelines/security>