Ship It Checklist

Checklists /Replit /Security

Critical

Do not leave the database open to the internet

A Replit database URL inside browser code, or a Postgres port left open, lets other people connect. The database should be reached by the server process only, with access checks for each user.

How to check

  1. Confirm the database connection string is read on the server, not in frontend JavaScript.
  2. If you use Supabase or Firebase as well, check row rules as you would for any other stack.
  3. Signed-out requests to your API should not return private rows.
  4. Do not paste the database URL into client code to 'just test'.

Prompt

Fix prompt
Paste into Cursor or Claude Code
You are working in this repository. Do not add features.

Goal: the database connection string is server-only, and each route checks the signed-in user before returning private rows.

Steps:
1. Find the database client. If any frontend file imports it, move those calls behind a server route.
2. Add an auth check on routes that return user data.
3. Do not log the connection string.
4. Describe how I can confirm a signed-out request fails.

This uses the same ticks as the checklist page, saved in this browser.

Related error fixes