spree-security

Harden Spree Commerce applications against XSS, CSRF, and SQL injection.

4|Updated Jun 9, 2026
One-click install
npx skills add https://github.com/spree/agent-skills --skill spree-security
Or copy as Structured Prompt for Agent
Please help me install this Agent Skill.
Skill: spree-security
Source: https://github.com/spree/agent-skills/tree/main/skills/spree-security
Command: npx skills add https://github.com/spree/agent-skills --skill spree-security

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) and references (resource) components.

What problem does it solve?

This Skill addresses the security concerns for Spree Commerce applications, providing guidance on hardening the app, responding to security findings, and setting up secrets management.

Core Features & Use Cases

  • Security Configuration: Offers best practices for configuring Content Security Policy (CSP), Cross-Origin Resource Sharing (CORS), and other security measures.
  • Secrets Management: Guides on handling secret keys and credentials securely.
  • Data Protection: Provides insights into securing payment data and customer information.
  • Use Case: When setting up a new Spree Commerce store, this Skill helps ensure that all security configurations are in place to protect sensitive data.

Quick Start

Secure your Spree Commerce app by running the 'spree-security' skill and following the guidelines provided.

Frequently Asked Questions about spree-security

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I secure a Spree Commerce application against XSS and SQL injection?

Securing Spree Commerce against XSS and SQL injection requires implementing security best practices like CanCanCan scopes and encrypted preferences. This Skill hardens your application by guiding you through specific configurations to prevent these common vulnerabilities.

What is the best way to configure CSP and CORS in Spree Commerce?

Configuring CSP and CORS in Spree Commerce involves applying specific security measures to control resource loading and cross-origin requests. This Skill provides best practices for setting up these headers to protect your store from malicious interactions.

How do I manage secret keys and credentials in Spree Commerce?

Managing secret keys in Spree Commerce requires securely handling credentials to protect sensitive data. This Skill guides you through setting up robust secrets management practices to ensure your application's sensitive information is never exposed.

Does Spree Commerce support PCI DSS compliance for payment data?

Spree Commerce supports PCI DSS compliance by allowing you to secure payment data and customer information. This Skill provides insights into data protection configurations that help align your store with these security standards.

Why do I need encrypted preferences for Spree Commerce security?

Encrypted preferences are needed for Spree Commerce security to protect sensitive store configurations from unauthorized access. This Skill focuses on specific Spree considerations like encrypted preferences to ensure your application data remains secure.