checklists
Security checklists you can run yourself.
The same checks Muster runs on every engagement, written down so you can run them by hand.
Fix a secret behind a public env prefix
NEXT_PUBLIC_, VITE_ and REACT_APP_ tell your bundler to publish a value to every visitor. Find the secrets hiding behind them.
Read checklist →Fix a secret key committed to source
A live API key in your repo is compromised the moment it's pushed. Rotate first, then remove it, then stop it happening again.
Read checklist →Fix a Supabase `service_role` key in your code
The Supabase service_role key bypasses every Row Level Security policy. Here is how to tell it from the anon key, rotate it and keep it server-side.
Read checklist →Fix an over-open CORS policy
A wildcard CORS policy is not always exploitable, but origin reflection with credentials is. How to tell the difference, fix it and prove it locally.
Read checklist →Fix missing or useless Row Level Security (Supabase)
A Supabase table without RLS is a public API. How to enable RLS, write a policy that actually scopes rows, and test it with two users.
Read checklist →Fix unsanitised HTML (`dangerouslySetInnerHTML`, `v-html`)
Rendering a variable as HTML lets user input run script in your users' sessions. Sanitise it or render text.
Read checklist →Vibe Coding Security Checklist (2026)
The security checklist for AI-generated and vibe-coded apps. Broken auth, injection, exposed secrets, and insecure defaults — found and fixed on every deploy.
Read checklist →Web Application Security Testing Checklist (2026)
The 25-point web application security testing checklist we use in every engagement. Auth, access control, injection, dependencies, and the fixes that actually close them.
Read checklist →