{
  "instruction": "Use SecurityFilterChain bean, not deprecated WebSecurityConfigurerAdapter",
  "relevant_when": "Agent creates or modifies a Spring Boot application with Spring Security",
  "context": "Since Spring Security 5.7 / Spring Boot 3.x, WebSecurityConfigurerAdapter is deprecated and removed. Always define security as a SecurityFilterChain @Bean method using the lambda DSL. Never extend WebSecurityConfigurerAdapter or use the deprecated chaining style (.csrf().disable()).",
  "sources": [
    {
      "type": "file",
      "filename": "skills/springboot-security-basics/SKILL.md",
      "tile": "tessl-labs/springboot-security-basics@0.2.0"
    }
  ],
  "checklist": [
    {
      "name": "security-filter-chain-bean",
      "rule": "Agent defines a @Bean method returning SecurityFilterChain rather than extending WebSecurityConfigurerAdapter",
      "relevant_when": "Agent creates or modifies Spring Security configuration"
    },
    {
      "name": "lambda-dsl-used",
      "rule": "Agent uses lambda DSL style (e.g., csrf(csrf -> csrf.disable())) rather than deprecated chaining style (e.g., .csrf().disable())",
      "relevant_when": "Agent configures HttpSecurity"
    }
  ]
}