Spree Commerce Security
Hardens Spree e-commerce deployments through comprehensive security audits, authentication configuration, and PCI compliance best practices.
This skill provides specialized guidance for securing Spree Commerce applications, covering the full stack from Rails credential hygiene and Devise authentication to advanced CanCanCan authorization and OAuth2 scopes. It helps developers mitigate OWASP Top 10 risks specific to Rails, lock down Ransack filter exposures, and ensure multi-store data isolation. By implementing secure webhook verification and maintaining PCI scope through gateway tokenization, it enables the creation of production-grade, hardened commerce platforms.
주요 기능
0132 GitHub stars
02OWASP Top 10 mitigation strategies tailored for Spree and Rails
03Configuration of in-core Devise and CanCanCan authorization rules
04Webhook HMAC-SHA256 signature verification implementation
05Security hardening for API v3 (Storefront & Admin) and OAuth2 (Doorkeeper)
06PCI scope reduction through gateway-side tokenization patterns
사용 사례
01Hardening a production deployment before launch or after a security incident
02Configuring multi-store data isolation and secure API access for third-party integrations
03Auditing an existing Spree application for common security vulnerabilities