quarkus-security

The quarkus-security skill is a defensive best-practices reference for securing Quarkus (Java) applications. It addresses the common problem of applications shipping without robust authentication, authorization, input validation, and safe data-access patterns by collecting canonical, secure Quarkus idioms in one place. The guidance is framed around when to activate it: adding JWT/OIDC/Basic auth, implementing role-based access, validating user input, configuring CORS and security headers, managing secrets, adding rate limiting, and scanning dependencies for CVEs.

It provides annotated Java code examples for JWT-protected resources, custom authentication filters, `@RolesAllowed` role-based access control, programmatic security checks with `SecurityIdentity`, and ownership verification. For input handling it demonstrates Bean Validation on DTOs and custom constraint validators, contrasts unsafe versus validated endpoints, and shows SQL-injection-safe patterns using Panache parameterized and named queries rather than string concatenation. It also covers secure password hashing with `BcryptUtil` and configuration examples for MicroProfile JWT and OIDC via `application.properties`, including sourcing secrets from environment variables.

The target users are Java/Quarkus backend developers, application security reviewers, and teams performing security-focused code review. Typical use cases include hardening new endpoints, reviewing authentication and authorization logic, preventing injection and validation flaws, and standardizing secure secret handling. The content is entirely security-hardening guidance with safe defaults, not offensive tooling.