Agent skill · security · jeremylongshore
juicebox-security-basics
Apply Juicebox security best practices.
Why this skill is useful
Provides specific security practices and code snippets for managing Juicebox API keys and protecting sensitive data that the AI wouldn't reliably generate on its own.
What it needs
About 3k tokens when loaded. Last updated 2026-08-07. 2,604 stars on the source repository.
What this skill does
Juicebox Security Basics Overview Juicebox provides AI-powered people search and analysis, processing datasets containing professional profiles, contact enrichment data, and query results. Security concerns include API key protection, GDPR/CCPA compliance for candidate and contact data, data retention policy enforcement, and ensuring enriched contact information (emails, phone numbers) is not leaked through logs or unencrypted storage. A compromised API key grants access to people search and enrichment capabilities. API Key Management Webhook Signature Verification Input Validation Data Protection Security Checklist [ ] API keys stored in secrets manager, separate keys per environment [ ] Enriched contact data encrypted at rest [ ] GDPR consent documented for EU candidate data [ ] CCPA opt-out mechanism implemented for California residents [ ] Data retention policy enforced (auto-delete after defined period) [ ] Contact enrichment results never logged in plaintext [ ] Search queries redacted in application logs [ ] Pre-commit hook blocks jblive credential patterns Error Handling Vulnerability Risk Mitigation --- --- --- Leaked API key Unauthorized people search and enrichment Secrets manager + key rotation Contact data in logs PII exposure violating GDPR/CCPA Field-level redaction pipeline Missing data retention Stale candidate data accumulates Automated retention enforcement Enrichment without consent Privacy regulation violation Consent gate before enrichment calls Unencrypted contact storage Bulk PII breach from database leak Encryption at rest + access controls Prerequisites A data classification, approved lawful-use basis, synthetic test fixture, secrets-manager references, least-privilege roles, and an incident owner with a tested revocation path. Instructions 1. Run the security checks only against a sandbox fixture and reject literal credentials, unapproved sources, or unapproved destinations. 2. …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills jeremylongshore/juicebox-security-basics