Agent skill · security · jeremylongshore
posthog-security-basics
Secure PostHog tokens, hosts, proxy routes, captured properties, and private-API scopes across browser and server boundaries. Use when reviewing secrets or hardening an integration. Trigger with "PostHog security", "PostHog secret scan", or "PostHog API key review".
Why this skill is useful
Provides specific commands and workflows for securely managing PostHog API keys that the AI wouldn't reliably generate on its own.
What it needs
Requires posthog account access. About 4k tokens when loaded. Last updated 2026-08-07. 2,604 stars on the source repository.
What this skill does
PostHog Security Basics Overview Secure PostHog API key management, least-privilege access, and secret rotation. PostHog has two key types with very different security profiles: the Project API Key (phc...) is intentionally public and safe to include in frontend bundles, while the Personal API Key (phx...) grants admin access and must never be exposed. Prerequisites PostHog account with admin access Understanding of environment variable management .gitignore configured Instructions Tool discipline Use Read to inspect the relevant configuration and implementation before proposing changes. Use Grep to locate initialization, capture, flag, and credential boundaries. Use Write only for a new, explicitly requested artifact inside the target project. Step 1: Understand Key Security Profiles Key Type Prefix Exposure Risk Capabilities ---------- -------- -------------- ------------- Project API Key phc Low (designed to be public) Capture events, evaluate flags, identify users Personal API Key phx Critical (full admin access) CRUD flags, read persons, query insights, delete data Step 2: Create Scoped Personal API Keys Step 3: Rotate Personal API Keys Step 4: Prevent Key Leaks Step 5: Server-Side Key Isolation Step 6: Audit API Key Usage Security Checklist [ ] Project key (phc) used for all frontend/capture code [ ] Personal key (phx) only on server, never in frontend bundles [ ] .env files in .gitignore [ ] Separate keys per environment (dev/staging/prod) [ ] Scoped personal keys (not full admin for every service) [ ] Git pre-commit hook scanning for phx keys [ ] Key rotation documented and scheduled (quarterly) Error Handling Issue Detection Fix ------- ----------- ----- Personal key in git history GitHub secret scanning alert Rotate key immediately, revoke old one Wrong key type 401 on admin API Use phx for admin, phc for capture Overprivileged key Audit log shows unexpected operations Create scoped key, revoke broad one Key exposed in logs Log scrubbing finds phx Redact l …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills jeremylongshore/posthog-security-basics