Pre-launch security checklist

Run this before you share your app with real users. Each item links to the guide that explains it.

Secrets

• No secret keys (service role, Stripe secret, OpenAI etc.) in frontend code or the public repo. Why
• Third-party APIs are called from server-side functions, with keys stored in the platform's Secrets.
• Any key that was ever exposed has been rotated.

Data access

• Row-level security / permissions enabled on every table or entity with user data.
• No "allow everyone" read rules on private data.
• Tested with two accounts and while signed out: user A can't see or change user B's data.
• Private file uploads are in private storage buckets.

Authentication

• Every server function or API route that reads or changes data checks who the caller is and what they're allowed to do.
• Webhooks verify the sender's signature.
• Leaked-password protection or strong password rules are on.
• Admin features check the user's role, not just that they're signed in.

Platform tools

• Ran your platform's built-in security scan (Lovable Quick + Deep scan, Bolt Security Audit, Base44 security scan, Supabase Security Advisor) and fixed Critical findings.
• Dependencies are up to date; no known critical vulnerabilities.

Web basics

• Security headers set (see OWASP HTTP headers cheat sheet).
• Error messages don't show stack traces, keys or internal details to users.
• Payments: prices and paid features are enforced on the server, never trusted from the browser.

If you handle sensitive data or money

• Get a professional security review before launch. This checklist isn't an audit.

Background reading: OWASP Top 10.