About

Imported from jeremylongshore/tons-of-skills-marketplace (plugins/saas-packs/framer-pack/skills/framer-security-basics/SKILL.md). Install upstream with npx skills add jeremylongshore/tons-of-skills-marketplace --skill framer-security-basics. Copyright stays with the author (MIT).

Framer Security Basics

Name: framer-security-basics
Author: jeremylongshore

Prerequisites

A security owner, least-privilege access policy, secret-manager references, domain/DNS ownership, and synthetic test project.

Output

Maintain a security receipt with identity scope, control result, access-review date, owner, and redacted incident state. Do not include keys, form submissions, or private content.

Error Handling

Deny unexpected permissions or publishing destinations, revoke access on suspected exposure, and route incidents through the designated owner.

Examples

Use a staging site to verify a temporary collaborator cannot publish to production, remove access, and record only the control outcome and opaque project reference.

Overview

Security best practices for Framer API keys, plugin development, and Server API access.

Instructions

Step 1: Credential Management

Credential	Scope	Where to Store
Server API Key (`framer_sk_*`)	Per-site	Secrets vault
Site ID	Per-site	Can be in config
Plugin auth tokens	Per-user session	Never persist

# .env (never commit)
FRAMER_API_KEY=framer_sk_abc123...
FRAMER_SITE_ID=abc123

# .gitignore
.env
.env.local

Step 2: Plugin Security

// Plugins run in Framer's iframe sandbox — limited browser APIs
// Never store secrets in plugin code (it's client-side)

// Fetch external data through your own API proxy
const data = await fetch('https://your-api.com/framer-data', {
  headers: { 'Authorization': `Bearer ${sessionToken}` },
});

Step 3: Server API Key Rotation

# 1. Generate new key in Framer site settings
# 2. Update in secrets vault
# 3. Test connection
node -e "
  const { framer } = require('framer-api');
  framer.connect({ apiKey: process.env.FRAMER_API_KEY, siteId: process.env.FRAMER_SITE_ID })
    .then(() => console.log('OK'))
    .catch(e => console.error('FAIL', e.message));
"
# 4. Revoke old key in site settings

Step 4: Security Checklist

API keys in environment variables, never in code
.env in .gitignore
Plugin never stores or exposes API keys
Server API accessed only from backend, never client
Pre-commit hook scans for framer_sk_* leaks
HTTPS-only for all API communication

Resources

Next Steps

For production deployment, see framer-prod-checklist.

Use it

Copy one of these into your project. Installing also returns the manifest and these snippets.

yaml

targets:
  - https://api.opensmartroute.ai/api/v1/registry/jeremylongshore-tons-of-skills-marketplace-framer-securi-bb7eb9/manifest   # or paste the manifest below

Manifest

An Open Capability Manifest: the router reads it to know what this does, what it costs and when to pick it.

jeremylongshore-tons-of-skills-marketplace-framer-securi-bb7eb9.ocm.jsonjson

{
  "ocm": "1",
  "id": "jeremylongshore-tons-of-skills-marketplace-framer-securi-bb7eb9",
  "kind": "skill",
  "name": "framer-security-basics",
  "description": "Apply Framer security best practices for secrets and access control. Use when securing API keys, implementing least privilege access, or auditing Framer security configuration. Trigger with phrases like \"framer security\", \"framer secrets\", \"secure framer\", \"framer API key security\".",
  "publisher": "jeremylongshore",
  "version": "1.0.0",
  "capabilities": {
    "domains": [
      "coding"
    ],
    "tags": [
      "skill-md",
      "saas",
      "framer",
      "skills-sh"
    ],
    "languages": [
      "en"
    ]
  },
  "quality_prior": 0.6,
  "examples": [
    "Apply Framer security best practices for secrets and access control. Use when securing API keys, implementing least privilege access, or auditing Framer security configuration. Trigger with phrases like \"framer security\", \"framer secrets\", \"secure framer\", \"framer API key security\"."
  ],
  "primary": false,
  "metadata": {
    "source": {
      "provider": "skills.sh",
      "repository": "https://github.com/jeremylongshore/tons-of-skills-marketplace",
      "path": "plugins/saas-packs/framer-pack/skills/framer-security-basics/SKILL.md",
      "ref": "HEAD",
      "url": "https://github.com/jeremylongshore/tons-of-skills-marketplace/blob/HEAD/plugins/saas-packs/framer-pack/skills/framer-security-basics/SKILL.md",
      "key": "jeremylongshore/tons-of-skills-marketplace/plugins/saas-packs/framer-pack/skills/framer-security-basics/SKILL.md"
    },
    "compatibility": "Designed for Claude Code",
    "allowed_tools": [
      "Read,",
      "Write,",
      "Grep"
    ],
    "license": "MIT"
  },
  "instructions": "# Framer Security Basics\n\n## Prerequisites\n\nA security owner, least-privilege access policy, secret-manager references, domain/DNS ownership, and synthetic test project.\n\n## Output\n\nMaintain a security receipt with identity scope, control result, access-review date, owner, and redacted incident state. Do not include keys, form submissions, or private content.\n\n## Error Handling\n\nDeny unexpected permissions or publishing destinations, revoke access on suspected exposure, and route incidents through the designated owner.\n\n## Examples\n\nUse a staging site to verify a temporary collaborator cannot ",
  "cost": {
    "context_tokens": 634
  }
}

Fetch it by URL: GET /api/v1/registry/jeremylongshore-tons-of-skills-marketplace-framer-securi-bb7eb9/manifest?version=1.0.0

Reviews

Star ratings from people who tried it. One review per account; edit yours any time.

No reviews yet. Install it, try it, and be the first to rate it.