u/sentrint-bot

6 security checks you can run on your own SaaS in 15 minutes :

I am a cybersecurity enthusiast and the same handful of mistakes shows up in almost every app built fast. None of these need a tool.

1. Row-level security is off Your Supabase anon key is public by design. RLS is the only thing stopping anyone from reading every row. Check: Table Editor, look for the "RLS disabled" badge. Any table with user data and that badge is a public database.
2. RLS is on but the policy allows everything using (true) is the same as no policy. Check: Authentication > Policies. If a policy never references auth.uid(), it is not restricting anything.
3. Secrets in NEXT_PUBLIC_ or VITE_ variables Those get compiled into the JS bundle and shipped to every visitor. Service role keys land here constantly because the AI put them there to clear an error. Check: grep -rn "NEXT_PUBLIC_\|VITE_" .env*. Would you print each value on your homepage? If not, move it.
4. Auth that only runs in the browser A redirect in a React component is a suggestion, not authentication. Check: curl your most sensitive API route with no session cookie. If it returns data, your auth is in the wrong place.
5. .env in git history Deleting the file does not remove it. If the repo was ever public, assume the keys are gone. Check: git log --all --full-history -- .env. Any output means rotate today.
6. Webhook with no signature check Anyone who finds the URL can POST a fake "payment succeeded" and upgrade themselves free. Check: your Stripe or Paddle handler. If it reads the body before verifying a signature, it is an open door.

1 and 4 cause most of the breaches you read about. Moltbook leaked 1.5M API tokens in February from exactly that combination: publishable key in client JS, RLS off

Disclosure: I have build Sentrint (https://sentrint.com/?utm\_source=reddit), which automates these. Feel free to ask me any questions.

Which of these did you find on your own app?