spring-security
Pass
Audited by Gen Agent Trust Hub on Apr 7, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill provides standard, high-quality documentation and code examples for securing Spring Boot applications using modern Spring Security 6.2+ components.
- [SAFE]: Instructions explicitly advocate for secure-by-default configurations, such as using
denyAll()orauthenticated()as a catch-all for API requests to prevent accidental exposure. - [SAFE]: The 'NEVER' section identifies and warns against critical security anti-patterns like hardcoding secrets, over-permissive CORS settings (
*), and unauthorized actuator endpoint exposure. - [SAFE]: CORS and CSRF configurations follow modern security standards, correctly explaining when it is safe to disable CSRF (stateless APIs) versus when it must remain enabled (session-based apps).
- [SAFE]: Testing guidance encourages comprehensive verification of both authorized and unauthorized access paths using standard Spring Security test utilities.
Audit Metadata