From 80% done to actually running. These are the points to tick off before you let the first real user in.
Access to data
- Row level security on for every table, with policies tied to the signed-in user.
- Roles in a separate table, not in the profile the user can edit.
- Storage buckets private, with temporary links for downloads.
- Tested with two accounts: user A sees nothing of user B.
Review the Supabase security checklist for all database settings.
Keys and secrets
- No service role key or API key in frontend code.
- Everything that ever touched the git history has been rotated.
- Secrets live in a secrets store, not in a bundled file.
Server functions and input
- Every server function checks who is calling it.
- User input is validated before anything is done with it.
- Error messages do not reveal internal details.
Also check how you handle passwords.
Dependencies and maintenance
- Packages updated and known vulnerabilities resolved.
- Backups on, and restored once to confirm they work.
- You know what data you keep, for how long, and who can reach it.
After launch
Security is not a one-off. Every change can introduce a new table, function or key. Have every push checked automatically instead of looking manually once a quarter.
Add uptime monitoring to detect outages quickly.
Frequently asked questions
How long does this checklist take?
For a small project usually half a day, provided you fix the points as you go rather than just noting them.
Does everything need to be done before the first user?
The data access and key points do. The rest can grow with your app.
Do I still need a pentest after this?
Once you handle real customer data or payments, yes. This checklist makes sure such a test is not full of avoidable findings.