Security checklist¶
Run this checklist before exposing an environment to real users.
Secrets¶
-
BETTER_AUTH_SECRETis unique per environment and at least 32 characters. -
.envis not committed; only.env.exampleis. - No secret uses the
VITE_prefix.
Origins and cookies¶
-
APP_URLandBETTER_AUTH_URLare the same public HTTPS origin. - No wildcard trusted origin is configured.
Proxy and rate limiting¶
-
TRUST_PROXYlists only your own ingress addresses. - The proxy overwrites forwarded client-IP headers.
Data¶
- MongoDB is not publicly reachable.
- Backups exist for the database volume.
- The integration test database has permission to be created and dropped, and the application database does not rely on that permission.
Application code¶
- Every private endpoint checks the session on the server.
- Request bodies are validated before use.