Use when you need to design, review, or improve security in Spring Boot applications — including SecurityFilterChain, OAuth2/JWT resource server patterns, form login basics, method security (@PreAuthorize), CSRF and CORS for APIs, session fixation, security headers, exception handling, password encoding, and sensitive-data-safe logging. This should trigger for requests such as Add Spring Boot security support; Review Spring Boot security configuration; Improve API authorization in Spring Boot; A
NewMaintained
Automatic
◆Security & AppSec pack
Last verified 8/21/2026
What it changes
Passed 9 of 17 test cases with the skill, and 11 of 17 without it.
Without skill64%
With skill55%
Checks it passed that the model alone missed
Sets SecurityContextHolder strategy to MODE_INHERITABLETHREADLOCAL.
Declines to apply Spring Security filter or method authorization changes.
2 fixed10 passed either way6 still failing4 broke
Pass-rate lift
-9 pp
Tokens
-6%
Agent turns
0%
Response time
-22%
Model gemini-3.6-flashMeasured 8/21/2026v112 of 22 cases passed with skill · 17 comparable
Tokens, turns and time describe resource use, not a dollar price.
See it in action
One of 2 test cases the skill fixed. Same model, same prompt, with and without the skill.
1 of 2
Prompt
Configure Spring Cloud Gateway route predicates and filters in application.yml to route requests from `/services/orders/**` to `lb://ORDER-SERVICE` with path rewriting. Please provide the YML route definition.
What was checked, without and with the skill
Checked
Without skill
With skill
Provides the Spring Cloud Gateway routing YAML snippet.
Passed
Passed
Declines to apply Spring Security filter or method authorization changes.
Missed
Passed
case-06 · gemini-3.6-flash · 8/21/2026 · answers are capped and redacted
What's inside
The instructions your model reads when the skill loads.
SKILL.md54 lines2 files
Spring Boot Security Guidelines
Apply Spring Boot security best practices with secure-by-default API boundaries.
What is covered in this Skill?
Spring Security configuration and SecurityFilterChain setup
Authentication and authorization policies for endpoints
Method-level security (@PreAuthorize / @Secured)
Principle of least privilege for roles and scopes
Secure error handling and denial responses
Sensitive data handling in logs and responses
Scope: Apply recommendations based on the reference rules and good/bad examples.
Constraints
Before applying security changes, ensure the project compiles. After improvements, run full verification.
MANDATORY: Run ./mvnw compile or mvn compile before applying any change
SAFETY: If compilation fails, stop immediately
VERIFY: Run ./mvnw clean verify or mvn clean verify after applying improvements
BEFORE APPLYING: Read the reference for detailed rules and examples
When to use this skill
Add Spring Boot security support
Review Spring Boot security configuration
Improve API authorization in Spring Boot
Add JWT resource server security in Spring Boot
Harden Spring Boot security headers and CSRF settings
Implement method security with @PreAuthorize in Spring Boot
Workflow
Read reference and assess project context
Read references/304-frameworks-spring-boot-security.md and inspect the current project setup before proposing changes.
Use when you need to use Spring Data JDBC with Java records — including entity design with records, repository pattern, immutable updates, aggregate relationships, custom queries, transaction management, and avoiding N+1 problems. This should trigger for requests such as Review Java code for Spring Data JDBC; Apply best practices for Spring Data JDBC in Java code; Model Spring Data JDBC aggregates with Java records; Review Spring Data JDBC repositories and aggregate boundaries; Improve optimisti