AutoGineer
Generated banner for Redis Security
Generated logo for Redis Security

Redis Security

RedisOfficialCreated by Redis, Inc.

  • Skill
  • Guidelines
  • Security
  • MIT
  • No issues found
Download ZIP

From the author

Redis security guidance covering authentication (requirepass and ACL users), TLS, ACL-based least-privilege access control, restricting network exposure via bind and protected-mode, firewall rules, and disabling dangerous commands. Use when deploying Redis to production, defining ACL users for an application, configuring TLS connections, locking down a Redis instance behind a firewall, or auditing a Redis deployment for security hardening.
— the description by Redis, Inc.

AutoGineer summary

Written by AutoGineer from the skill’s own files, not by the author

This skill provides essential security practices for hardening Redis instances. It emphasizes a multi-layered approach to protection, focusing on mandatory authentication, the implementation of least-privilege access control via ACLs, and the restriction of network exposure. The guidance covers configuration patterns for production environments, including TLS setup, firewall rules, and the management of dangerous commands to minimize the impact of potential security incidents.

What it does

  • Provides configuration patterns for enabling authentication and TLS in Redis.
  • Explains how to implement least-privilege access using ACL users and command categories.
  • Details methods for restricting network exposure through bind settings and protected-mode.
  • Offers guidance on using firewalls to limit access to specific application subnets.
  • Suggests techniques for disabling or renaming destructive commands to prevent accidental or malicious data loss.

When to use it

  • When deploying a new Redis instance to a production environment.
  • When auditing an existing Redis deployment for security vulnerabilities.
  • When configuring application credentials to move beyond shared passwords.
  • When addressing security findings related to Redis instances exposed to the internet.

Advantages

  • Reduces the blast radius of compromised credentials through granular ACLs.
  • Prevents clear-text data transmission by enforcing TLS.
  • Limits unauthorized access by restricting network interfaces and firewall rules.
  • Provides a structured approach to hardening Redis against common exploitation vectors.

Usage examples

“How do I secure my Redis instance for production?”
The agent provides a checklist covering mandatory authentication, TLS configuration, ACL user setup, and network binding best practices.
“Show me how to restrict a Redis user to read-only access.”
The agent provides the ACL SETUSER command syntax to create a user restricted to specific key patterns and read-only command categories.

Install

  1. Download the skill as a ZIP:

    https://mp-staging.autogineer.com/agent-skills/redis/redis-security/download

  2. Unzip it into the cross-client skills folder of your project:

    mkdir -p .agents/skills && unzip redis-security.zip -d .agents/skills

Documentation by Redis, Inc.

Redis Security

Production hardening for Redis: authentication, ACL-based access control, and network exposure. Cover all three together — any one of them on its own leaves an exploitable gap.

When to apply

  • Deploying or reviewing a Redis instance destined for production.

  • Setting up application credentials beyond a shared password.

  • Auditing a Redis deployment against a security checklist.

  • Receiving "Redis exposed to the internet" findings from a scanner.

1. Always authenticate (and use TLS)

Never run a production Redis without a password. Pair authentication with TLS so credentials and data aren't sent in clear text.

# redis.conf
requirepass your-strong-password
tls-port 6380
tls-cert-file /path/to/redis.crt
tls-key-file  /path/to/redis.key
r = redis.Redis(
    host="localhost",
    port=6380,
    password="your-strong-password",
    ssl=True,
    ssl_cert_reqs="required",
)

If you can use ACL users (next section) instead of the single requirepass, do — requirepass is effectively the legacy "default user" shortcut.

See references/auth.md.

2. ACLs for least-privilege access

The default user with a shared password is fine for development. For production, give each application a dedicated ACL user with only the commands and key patterns it actually needs.

# Cache-only reader
ACL SETUSER app_readonly on >password ~cache:* +get +mget +scan

# Writer that can't run dangerous ops
ACL SETUSER app_writer   on >password ~*        +@all -@dangerous

# Admin (use sparingly, never for application traffic)
ACL SETUSER admin        on >strong-password ~* +@all

Useful command categories:

CategoryWhat it covers
@readRead commands (GET, MGET, HGET, ...)
@writeWrite commands (SET, DEL, XADD, ...)
@dangerousFLUSHALL, DEBUG, KEYS, etc.
@adminAdministrative commands

If app credentials leak, a tight ACL bounds the blast radius — the attacker can't FLUSHALL your DB just because they grabbed a cache reader's password.

See references/acls.md.

3. Restrict network access

The most common Redis breach is a public-internet Redis with no auth. Avoid that with three layers:

# redis.conf — bind to specific interfaces, keep protected-mode on
bind 127.0.0.1 192.168.1.100
protected-mode yes
# Firewall — allow only application subnets
iptables -A INPUT -p tcp --dport 6379 -s 192.168.1.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 6379 -j DROP

Anti-pattern: bind 0.0.0.0 + protected-mode no — exposes Redis to the whole network without protection.

Optional but recommended: rename or disable destructive commands so a compromised client can't trash the DB:

rename-command FLUSHALL ""
rename-command DEBUG ""
rename-command CONFIG ""

See references/network.md.

References

Files

Requirements and compatibility

Works with: Claude Code, Claude apps, OpenAI Codex, GitHub Copilot, Cursor, Gemini CLI, Kiro, OpenCode, Goose, Amp, Roo Code, JetBrains Junie, Factory Droid, Devin (ex-Windsurf), Mistral Vibe, OpenHands, Letta

“Works with” means the tool reads the open Agent Skills format; a skill written for one tool may use features others lack.

Needs: Needs Python

Security

No issues found by our static scan· No issues found

A static scan is not a guarantee. Skills are third-party content: review a skill before you let an agent use it.

Attribution and licence

Created by
Redis, Inc.
Publisher
Redis (Official)
Source
redis/agent-skills · skills/redis-security · commit 74708da
Licence
MIT License (redistribution allowed)
  • LICENSE (added by AutoGineer from LICENSE)
  • ATTRIBUTION.md (written by AutoGineer)
Synced
Also distributed in
redis/agent-skills

AutoGineer is not affiliated with or endorsed by Redis, Inc. or Redis.

Download ZIP

The ZIP holds the skill’s files, its licence files and an ATTRIBUTION.md. Download redis-security.zip