better-auth-security-best-practices: a Claude Code skill by Better Auth
Official
For developers running Better Auth who want to lock down sessions, cookies and sign-in limits before launch. Skip it if your app uses a different auth library.
- Score
- 76of 100
- Rank
- #103of 239
- Installs
- 51Kon skills.sh
- Security
- Clear 3 scanners
- Updated
- 2026
- Context
- ~89tokens always
Install
npx skills add https://github.com/better-auth/skills --skill better-auth-security-best-practices
Run it in your terminal. View the source
Using the Claude app rather than Claude Code? You can add a skill there too. How to add it in the app
What does better-auth-security-best-practices do?
better-auth-security-best-practices is a Claude skill that walks Claude through hardening a Better Auth setup in its TypeScript config. It covers where the secret is read from and how to generate one with openssl, rate limit windows and storage with stricter defaults on sign-in and sign-up routes, and CSRF checks that should stay on. It explains trusted origins, including wildcards and per-request lists, session expiry and cookie caching strategies, cookie attributes and cross-subdomain cookies. Further sections handle encrypting OAuth tokens with AES-256-GCM, IP header settings behind proxies, audit logging through database hooks and a checklist to run before deploying.
When should you use better-auth-security-best-practices?
Use it when
- Preparing a Better Auth app for production
- Sign-in endpoints are getting brute forced
- Sharing a login across subdomains
Skip it when
- Your app uses a different auth library
What it needs and what it can touch
You need
- A project that uses the Better Auth library
From reading its instructions, not from running it.
Why it scores 76
Strongest on upkeep (100 of 100), weakest on adoption (46).
Is better-auth-security-best-practices safe to install?
Every scanner that checked it passed it. Scanners often miss what other scanners catch, and a skill can change after a scan. Read its source before you install it.
| Scanner | Result | Date |
|---|---|---|
| Gen Agent Trust Hub | Passed | Jul 11, 2026 |
| Socket | Passed | Jul 11, 2026 |
| Snyk | Low risk | Jul 11, 2026 |
Details
- Installs
- 50,970
- Repository stars
- 229
- Last repository change
- Tokens always loaded
- about 89
- Tokens when used
- about 2,554
- License
- Not stated
- Data confidence
- High
Did it do the job for you?
Alternatives to better-auth-security-best-practices
All skills for this job-
Get better-auth-best-practices
better-auth-best-practices
For TypeScript developers setting up or changing Better Auth sign-in, sessions and plugins.
-
Get security-reviewsecurity-review
For web developers adding login, payments, uploads or new API routes who want a security checklist at hand.
-
Get email-and-password-best-practices
email-and-password-best-practices
For TypeScript developers adding email and password login with Better Auth.
-
Get security-and-hardeningsecurity-and-hardening
For web developers handling input, logins or personal data who want clear always, ask-first and never rules.
better-auth-security-best-practices