Agent skill · security · jeremylongshore
hex-security-basics
Apply Hex security best practices for secrets and access control.
Why this skill is useful
Provides specific security practices and code snippets for managing API keys and protecting sensitive data in Hex, which the AI wouldn't reliably generate on its own.
What it needs
About 3k tokens when loaded. Last updated 2026-08-07. 2,604 stars on the source repository.
What this skill does
Hex Security Basics Overview Hex is a collaborative data analytics platform where notebooks query production databases, generate visualizations, and share results across teams. Security concerns center on API token management (read vs run scopes), protecting database connection credentials embedded in Hex projects, and ensuring query results containing sensitive business data are not leaked through logs or exports. A compromised run-scope token can trigger arbitrary queries against connected databases. API Key Management Webhook Signature Verification Input Validation Data Protection Security Checklist [ ] API tokens stored in secrets vault, never in code [ ] Read-only tokens for monitoring, run tokens for orchestration only [ ] Token expiration set to 90 days maximum [ ] Separate tokens per environment (dev/staging/prod) [ ] Pre-commit hook blocks hextoken patterns [ ] Database connection credentials managed in Hex workspace settings [ ] Query result exports reviewed for sensitive data before sharing [ ] Notebook sharing permissions audited per team Error Handling Vulnerability Risk Mitigation --- --- --- Leaked run-scope token Arbitrary queries against production databases Secrets vault + least-privilege scoping Database credentials in notebooks Connection strings exposed to all collaborators Hex workspace-managed connections Query results in logs Sensitive business data leaked Field-level redaction pipeline Overly broad notebook sharing Confidential analytics visible to wrong teams Per-notebook permission scoping No token expiration Indefinite access from compromised token 90-day expiration policy Prerequisites A threat model naming token custodians, project/data owners, untrusted parameters, incident owner, and approved secret manager. Low-privilege sandbox credentials and a project that contains no production-sensitive fixtures for verification. Rotation, revocation, project-disable, and cancellation runbooks with tested rollback. Instructions 1. …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills jeremylongshore/hex-security-basics--d57b9b