SaaS Pre-Launch Security Checklist: 10 Essential Checks Before Production
A step-by-step pre-launch security checklist for SaaS applications: Supabase RLS, API secrets, IDOR prevention, Stripe webhook verification, and rate limiting.
Before launching a SaaS to production, 10 security checks are non-negotiable: enable PostgreSQL Row-Level Security on all tables, ensure secret keys (Stripe, OpenAI) are never bundled into client JS, verify cryptographic webhook signatures, and enforce rate limiting on authentication routes.
1. Data Access & Row-Level Security (RLS)
In Supabase and PostgreSQL, RLS is disabled by default on newly created tables. Anyone with your public anon key can query and modify unprotected tables via the REST API.
- **Check 1:** Run an audit to verify that every public table has `ENABLE ROW LEVEL SECURITY`.
- **Check 2:** Never leave a `USING (true)` policy in production without scoping to `auth.uid()`.
- **Check 3:** Write explicit policies for `SELECT`, `INSERT`, `UPDATE`, and `DELETE`.
-- Query all tables with RLS disabled in your database
SELECT tablename
FROM pg_tables
WHERE schemaname = 'public'
AND rowsecurity = false;2. API Keys & Secrets in Client Bundles
In Next.js and frontend frameworks, any environment variable prefixed with `NEXT_PUBLIC_` is compiled directly into the client JavaScript bundle.
- **Check 4:** Ensure private Stripe keys (`sk_live_`), OpenAI tokens (`sk-`), and Supabase `service_role` keys are never exposed in client bundles.
- **Check 5:** Inspect network requests in DevTools to confirm that no third-party APIs are called directly from the client without server routing.
3. Authentication & IDOR Protection
Insecure Direct Object References occur when an API route accepts a resource ID without verifying that the logged-in user owns that resource.
- **Check 6:** In every Server Action or API endpoint, verify ownership server-side.
- **Check 7:** Enforce rate-limiting on login, signup, and password reset endpoints to block credential stuffing.
Frequently asked questions
What is the most common vulnerability in modern SaaS apps?
Missing or misconfigured Supabase Row-Level Security (RLS), where developers leave tables without policies or use overly permissive USING (true) rules.
How do I check if my secret keys are leaked in my client code?
Open your browser's Developer Tools (F12), search the loaded JS sources for patterns like 'sk_live_' or 'service_role'.
Is your SaaS ready for production?
Identify critical vulnerabilities before your users do with the Validra Security Review in 5 business days.