Agent skill · security · jeremylongshore
lokalise-security-basics
Apply Lokalise security best practices for API tokens and access control.
Why this skill is useful
Provides specific practices for managing API tokens and validating translation content that the AI wouldn't reliably generate on its own.
What it needs
Requires lokalise account access. About 5k tokens when loaded. Last updated 2026-08-07. 2,604 stars on the source repository.
What this skill does
Lokalise Security Basics Overview Security practices for Lokalise integrations: API token management with scoped permissions, translation content sanitization, CI/CD secret handling, webhook secret verification, and audit logging. Lokalise handles translation strings that may contain user-facing content, interpolation variables, and occasionally PII embedded in keys or values. Prerequisites Lokalise API token provisioned (admin token for audit, scoped tokens for operations) Understanding of Lokalise token permission model (read-only vs read-write) Secret management infrastructure (GitHub Secrets, AWS Secrets Manager, GCP Secret Manager, or Vault) Instructions Step 1: Token Scope Management Lokalise API tokens are either read-only or read-write. Create separate tokens per use case to enforce least privilege. Step 2: Validate Translation Content Translation strings may contain interpolation variables, HTML, or user-generated content. Validate before rendering. Step 3: Webhook Secret Verification Lokalise sends a random alphanumeric secret in the X-Secret header. Always verify it. Step 4: CI/CD Token Security Step 5: Scan for Hardcoded Tokens Step 6: Audit Translation Changes Output Scoped token configuration with separate read/write/admin tokens Translation content validator catching XSS, credential leaks, and malformed placeholders Webhook secret verification middleware for Express CI/CD workflow using repository secrets with masked output Pre-commit/CI scan script for hardcoded tokens Audit logging for translation changes (PII-safe) Error Handling Issue Cause Solution ------- ------- ---------- Token leaked in CI logs Token in command output Use env variables; GitHub Actions auto-masks secrets XSS via translations Unsanitized translation rendered as HTML Validate with validateTranslation() before use Overprivileged access Using admin token for read-only operations Create scoped tokens per use case Unauthorized changes No audit trail Register webhook for project.tran …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills jeremylongshore/lokalise-security-basics