security

Run the security check at the review stage: verify no secret moves toward a client bundle, confirm server-only values go through a server-only module, and ensure no secret env var carries a NEXT_PUBLIC_ prefix. A bundle verification script in CI catches what review misses.

Secrets should live in local files such as ~/.secrets/*.env, never in a repository, vault, ticket, or transcript. Reference them by location only, and if a credential leaks into a transcript or ticket, rotate it at the source and fix the leak path.

Use the anon key with Row Level Security for anything client-side; the service role key bypasses RLS and must never reach client code. Changes to tables like public.accounts should go through migrations with policy review first.

Process argument lists are world-readable via tools like ps, so flags such as --password or --token expose values to any user on the machine. Redact such arguments before printing command lines and treat any leaked value as a compromised credential.

A checklist only covers cases it has explicit rules for, so it cannot catch novel vulnerability classes or replace a full audit. The mitigation is to name what the check could not cover on each run and add new rules only when a real incident or finding pays for them.