php-authentication-security
Pass
Audited by Gen Agent Trust Hub on Sep 19, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill documents industry-standard security practices for PHP authentication, including the use of native password hashing APIs (
password_hash,password_verify) and preference for Argon2id. - [SAFE]: It provides specific guidelines for protecting against account enumeration by using generic error messages and dummy hashing/verification paths for non-existent accounts.
- [SAFE]: It recommends secure token handling practices for password resets and verification, such as hashing tokens at rest, ensuring one-time use, and avoiding token exposure in logs.
- [SAFE]: It emphasizes proper session management, including ID rotation at privilege changes, server-side timeout enforcement, and revalidating account status on every request.
- [SAFE]: Recommendations for external libraries (such as
mezzio/mezzio-authentication) refer to well-known, legitimate software within the PHP ecosystem and trace back to expected vendor functionality.
Audit Metadata