Agent skill · security · jeremylongshore
flyio-security-basics
Harden Fly.io tokens, deploy authority, App secrets, private networking, images, and operational evidence with least privilege. Use when establishing or reviewing platform security. Trigger with: "secure Fly app", "audit Fly tokens", "harden Fly private network".
Why this skill is useful
Provides specific security practices and code snippets for managing Fly.io secrets and tokens that the AI wouldn't generate reliably on its own.
What it needs
Requires fly.io account access. About 3k tokens when loaded. Last updated 2026-08-07. 2,604 stars on the source repository.
What this skill does
Fly.io Identity, Secrets, and Network Baseline Overview Protect the control plane, deployed code, runtime secrets, images, network paths, and support evidence as one system. Scoped tokens reduce control-plane authority, but deploy access remains highly sensitive because new code can read secrets injected into Machines. Prerequisites Human and workload identity inventory with owners and expiry policy Apps, process groups, images, domains, certificates, private peers, and data flows Incident, rotation, vulnerability, and access-review procedures Instructions Step 1: Separate identity classes Distinguish interactive operators, app deploy automation, organization automation, read-only monitoring, SSH, Machine-exec, WireGuard, database, and external-service identities. Step 2: Apply least privilege and expiry Use app deploy tokens for one app, read-only organization tokens for observation, and short-lived command or SSH tokens for bounded access. Review and revoke by token ID. Step 3: Protect runtime secrets Store app values through Fly secrets, inspect only names and digests, stage changes when appropriate, and prevent deployed code, logs, crashes, and support bundles from exfiltrating values. Step 4: Control code and images Require reviewed immutable images, dependency and vulnerability gates, provenance, protected production environments, release approval, and rollback. Treat image registry and build credentials separately. Step 5: Protect network paths Map public services, certificates, 6PN, Flycast, WireGuard peers, outbound destinations, and application authentication. Private reachability does not imply trusted requests. Step 6: Prove operations Exercise token rotation, emergency revocation, secret update, deploy rollback, access review, log redaction, and incident escalation with timestamped receipts. Authentication Current guidance deprecates routine use of the all-powerful fly auth token output. …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills jeremylongshore/flyio-security-basics--c4d381