Security Checklists

Step-by-step checklists you can run before launch · from platform-specific lists to full 25-point web app audits.

  • Supabase Security Checklist: Protect Your Database in Production · Supabase is not secure by default because the anon key is public; you must enable Row Level Security (RLS) on every table to prevent unauthorized access. To protect production apps, keep the service_role key server-side, enforce email confirmation, enable leaked-password protection, and restrict Edge Function CORS to your domain.
  • Cursor App Security Checklist: 10 Things to Check Before You Ship · Before shipping a Cursor-built app, you must verify 10 critical security areas: eliminate hardcoded secrets, enforce RLS policies, implement server-side auth guards, validate all inputs, sanitize error messages, patch dependencies, configure security headers, restrict CORS origins, manage tokens in httpOnly cookies, and audit client-side logic for authorization bypasses.
  • Firebase Security Checklist: Protect Your AI-Built App · To secure a Firebase app before launch, you must replace "test mode" rules with granular production rules, restrict API keys by HTTP referrer in the Google Cloud Console, and enable Firebase App Check to block unauthorized clients. Transitioning from AI-generated "Test Mode" requires moving beyond the 30-day expiry window.
  • React Security Checklist: 10 Vulnerabilities to Fix Before Launch · React apps are client-side, making every secret and route guard visible to users. To secure your app before launch, you must move API keys to the server, sanitize HTML with DOMPurify, validate user-provided URLs, and enforce backend authentication for every sensitive request rather than relying on frontend logic.
  • Web App Security Audit Checklist: 25 Checks Before Launch · A web app security audit requires checking 25 critical points across authentication, authorization, and infrastructure. SimplyScan's data shows 30% of AI-built apps have high-severity risks like exposed keys or missing RLS. Use this checklist to secure your vibe-coded apps before launch and ensure production-grade safety for your users.
  • Claude Code Security Checklist: Ship Agent-Written Code Safely · Secure Claude Code by securing the session: keep auto-approval off for shell commands, use deny-rules for .env files so secrets never enter the context, treat external content as a potential prompt-injection vector, and always scan the deployed app to catch configuration drift and exposed secrets.
  • How to Check if a Website Is Secure: A 10-Minute Audit · To check if a website is secure, run five free passive checks: confirm HTTP redirects to a valid HTTPS certificate with TLS 1.2+, verify security headers like CSP and HSTS, scan for exposed .env and .git files, check SPF, DKIM, and DMARC records, and look for a public status page. The whole audit takes about ten minutes.
  • The Complete Application Security Checklist for 2026 · A complete application security checklist for 2026 covers authentication, secret management, database RLS, security headers, and input validation. With 30% of AI-built apps containing high-severity risks, you must move beyond manual reviews to automated scanning and rigorous server-side authorization to protect your users and data.
  • Broken Access Control Checklist · Find and Fix OWASP A01 · Broken access control (OWASP A01) occurs when an app fails to restrict users from accessing data or functions they do not own. To fix it, you must implement server-side ownership checks, enforce role-based access control (RBAC), and enable Row-Level Security (RLS). Never rely on the UI to hide buttons.
  • The Ultimate Vibe Coding Security Checklist: Ship AI Apps Safely · A vibe coding security checklist ensures AI-generated apps are safe for production. Key steps include auditing for exposed API keys, verifying Supabase RLS policies, and validating security headers. Using automated tools like SimplyScan allows developers to maintain the speed of vibe coding without compromising on essential security best practices.
  • The Vibe Coding Security Audit Checklist: Shipping Fast Without Leaking Data · Vibe coding is an AI-driven development method where software is built by describing intent in natural language. While it enables rapid shipping, SimplyScan's data shows 33% of these apps contain high-severity security flaws. A proper audit requires scanning for exposed API keys, verifying database RLS, and checking security headers.
  • Modern Security Audit Procedures for Vibe-Coded Applications · Modern security audit procedures for AI-built apps prioritize automated, continuous validation over manual checks. By integrating tools like SimplyScan into the vibe-coding workflow, developers can detect critical risks like exposed API keys, missing Supabase RLS, and broken authentication in seconds, ensuring that rapid AI development does not compromise integrity.

Browse other categories: Platform Security Guides · Vulnerabilities & Fixes · Database & API Security · Comparisons & Reviews · Speed & Performance · AI Coding Security · Security Fundamentals

All security guides