quarkus-security
Quarkus security implementation patterns: JWT and OIDC authentication
by affaan-mFree
Description
quarkus-security is an agent skill from the ECC collection by affaan-m, listed on skills.sh. It is a security review guide for Quarkus applications, covering authentication, authorisation and input validation. It sets out JWT and OIDC authentication, Basic authentication, role-based access with @RolesAllowed and SecurityIdentity checks, Bean Validation and custom validators, CORS and security headers, and the handling of secrets through Vault, environment variables and config sources. It also covers rate limiting and brute-force protection, scanning dependencies for CVEs, and working with MicroProfile JWT or SmallRye JWT. The skill applies when adding authentication, implementing authorisation, validating user input, configuring CORS or headers, managing secrets, or reviewing dependencies. It is a checklist-style reference for an agent writing or reviewing code, not a replacement for a formal security assessment. It is a SKILL.md file that an AI agent loads when a task calls for it. It is free and open source, and the skills.sh listing shows all three security audits passing.…
Highlights
- JWT and OIDC authentication
- @RolesAllowed and SecurityIdentity checks
- Bean Validation and custom validators
- Secrets, CORS, rate limiting and CVE scanning
Ratings & Reviews
No ratings yet
Be the first to rate quarkus-security.
People also visit
quarkus-security FAQ
What does the quarkus-security skill do?
It guides an agent in securing Quarkus apps: authentication with JWT or OIDC, role checks, input validation, CORS, secrets and dependency scanning.
Which authentication methods does it cover?
JWT, OIDC and Basic authentication, plus MicroProfile JWT and SmallRye JWT.
Can it replace a security audit?
No. It is a checklist for an agent to apply while building and reviewing code.
How do I install it?
Run: npx skills add https://github.com/affaan-m/ecc --skill quarkus-security
Is it free?
Yes. It is free and open source.
Are there security findings?
The skills.sh listing shows Gen Agent Trust Hub, Socket and Snyk all passing.
What are the best quarkus-security alternatives?
Popular alternatives to quarkus-security include java-coding-standards, quarkus-patterns and quarkus-tdd. See all quarkus-security alternatives