spree-security
Installation
SKILL.md
Contains Shell Commands
This skill contains shell command directives (!`command`) that may execute system commands. Review carefully before installing.
Spree Security
Spree inherits Rails' security model and adds an e-commerce attack surface: payment flows, customer PII, staff credentials and outbound webhooks. This skill covers what a developer extending Spree 6 has to get right. For who may do what (roles, permission keys, scopes, storefront ownership, SSO), see spree-auth-permissions.
Threat model in four lines
- Store API: internet-facing and called by untrusted clients. Risks: IDOR on carts/orders, XSS via catalog content, abuse of cart/auth endpoints.
- Admin API + dashboard: staff credentials get phished and integrations leak keys. Risks: over-scoped secret keys, cross-store leaks in custom controllers, privilege creep in roles.
- Payments: money and PCI. Risks: card data in logs or the DB, unverified gateway webhooks, refund abuse.
- Outbound traffic: webhooks and integrations. Risks: SSRF, unverified receivers.