Spatie Security Guidelines

Overview

When to Activate

• Activate this skill when configuring application security (authentication, authorization, forms).
• Activate this skill when setting up or reviewing database configurations.
• Activate this skill when configuring servers or reviewing infrastructure.
• Activate this skill when reviewing code for security vulnerabilities.

Scope

• In scope: Application security, database security, server configuration, credential management.
• Out of scope: Code style, business logic, UI/UX design.

Application Security

• Transmit all HTTP traffic over SSL.
• Use CSRF tokens in all forms.
• Use appropriate HTTP methods for significant actions:

  DELETE

  ,

  POST

  ,

  PUT

  — never

  GET

  .
• Add automated authorization tests to verify only authorized users can access restricted functionality.

Database Security

• Hash all stored passwords.
• Encrypt API keys stored in databases.
• Use separate database users per database with appropriate read/write permissions.
• Restrict database access to whitelisted hosts only (webserver and developer machines).

Server Security

• Keep NGINX, PHP, Ubuntu, and similar software up to date.
• Use SSH with private key authentication; disable password authentication.
• Install and enable

  unattended-upgrades

  for automatic security updates.
• Configure firewalls to permit only necessary traffic (typically ports 22 and 443).
• Manage all servers through Ansible for rapid patching and access revocation.

Credential Management

• Store all passwords in a password manager (e.g. 1Password).
• Ensure each password is unique; no reuse.
• Enable two-factor authentication when available.
• Protect all private keys with passwords.

General

• Use backups (e.g. BackBlaze) and test them periodically.
• Enable FileVault (full-disk encryption) on all Macs.
• Never use public services like Pastebin for sensitive code or data.
• Install browser extensions only from official stores; minimize usage.