quarkus-security
Quarkus Security best practices for authentication, authorization, JWT/OIDC, RBAC, input validation, CSRF, secrets management, and dependency security.
npx skills add mturac/everything-openai-codex --skill quarkus-security --agent codex
Same command for any agent — swap --agent for claude-code, cursor, copilot.
Weekly change comes from our own snapshots, not the repository page — it measures attention, not adoption.
# Quarkus Security Review Best practices for securing Quarkus applications with authentication, authorization, and input validation. ## When to Activate - Adding authentication (JWT, OIDC, Basic Auth) - Implementing authorization with @RolesAllowed or SecurityIdentity - Validating user input (Bean Validation, custom validators) - Configuring CORS or security headers - Managing secrets (Vault, environment variables, config sources) - Adding rate limiting or brute-force protection - Scanning dependencies for CVEs - Working with MicroProfile JWT or SmallRye JWT ## Authentication ### JWT Authentication ```java // Resource protected with JWT @Path("/api/protected") @Authenticated public class ProtectedResource { @Inject JsonWebToken jwt; @Inject SecurityIdentity securityIdentity; @GET public Response getData() { String username = jwt.getName(); Set<String> roles = jwt.getGroups(); return Response.ok(Map.of( "username", username, "roles", roles, "principal", securityIdentity.getPrincipal().getName() )).build(); } } ``` Configuration (application.properties): ```properties mp.jwt.verify.publickey.location=publicKey.pem mp.jwt.verify.issuer=https://auth.example.com # OIDC quarkus.oidc.auth
- When to Activate
- Authentication
- JWT Authentication
- Custom Authentication Filter
- Authorization
- Role-Based Access Control
- Programmatic Security
- Input Validation
- Bean Validation
- Custom Validators
- SQL Injection Prevention
- Panache Active Record (Safe by Default)
- Native Queries (Use Parameters)
- Password Hashing
Maven mvn org.owasp:dependency-check-maven:check Gradle Check Quarkus extensions quarkus extension list --installable
What does the quarkus-security skill do?
Quarkus Security best practices for authentication, authorization, JWT/OIDC, RBAC, input validation, CSRF, secrets management, and dependency security.
How do I install it?
Run `npx skills add mturac/everything-openai-codex --skill quarkus-security --agent claude-code` — it drops the skill into your project so the agent can pick it up. Swap the --agent value for codex, cursor or copilot if you use one of those.
Where does this skill come from?
From mturac/everything-openai-codex, a repository with 84 stars. We read it straight from the repository tree rather than a submitted listing, so what you see here is what is actually published.
Is a popular skill a good skill?
Not necessarily. Stars measure attention, not adoption — a repository can trend for a week and be abandoned. That is why we show the weekly change from our own snapshots next to the total, instead of a single flattering number.