Agent skill · security · jeremylongshore
langfuse-security-basics
Implement Langfuse security best practices for API keys and data privacy.
Why this skill is useful
Provides specific Langfuse security practices and code snippets for API key management and data privacy that the AI wouldn't reliably generate on its own.
What it needs
Requires langfuse account access. About 4k tokens when loaded. Last updated 2026-08-07. 2,604 stars on the source repository.
What this skill does
Langfuse Security Basics Overview Security practices for Langfuse LLM observability: credential management, PII scrubbing before tracing, self-hosted hardening, data retention, and secret scanning. Prerequisites Langfuse instance (cloud or self-hosted) API keys provisioned Understanding of data privacy requirements (GDPR, SOC2, HIPAA) Instructions Step 1: Credential Security Langfuse uses two keys with different security profiles: Key security rules: Public key (pk-lf-...): Identifies the project. Safe in client-side code. Secret key (sk-lf-...): Grants write access. Server-side only. Store in environment variables or secret manager -- never in source code. Rotate keys immediately if exposed in logs, git, or error reports. Step 2: PII Scrubbing Before Tracing Langfuse stores everything you send. Scrub PII from inputs and outputs before tracing. Step 3: Self-Hosted Hardening Step 4: Git Secret Scanning Prevent Langfuse keys from being committed: Step 5: Scoped API Keys and Least Privilege Security Checklist Category Check Status ---------- ------- -------- Credentials Secret key in env vars / secret manager only Credentials Keys validated at startup (no swap) Credentials .env files in .gitignore Data Privacy PII scrubbed from trace inputs/outputs Data Privacy Retention policy configured Self-Hosted Signup disabled, SSO enforced Self-Hosted Encryption key set for data at rest CI/CD Secret scanning in pipeline Access Least-privilege roles per team member Error Handling Issue Cause Solution ------- ------- ---------- PII in traces Not scrubbing before trace Apply scrubPII() to all inputs/outputs Secret key leaked Key in source code Rotate immediately, add secret scanning Unauthorized access Default roles too permissive Set LANGFUSEDEFAULTPROJECTROLE=VIEWER Data accumulation No retention policy Set LANGFUSERETENTIONDAYS Output Produce a security checklist with an accountable owner for each control: credential storage and rotation, trace-data minimization, retention, acce …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills jeremylongshore/langfuse-security-basics