Security & privacy

Security overview

Protect your apps with API key detection, database access controls, and security scanning during development.

Startbase provides built-in security tools to help reduce common application security risks during development and before publishing. These tools support secure development, but they do not replace a thorough security review.

Protecting API keys

Startbase generates frontend code that runs in the browser, so API keys cannot be stored safely in client-side code. To prevent exposure, Startbase automatically detects API keys in prompts and guides you to store them securely in Cloud → Secrets instead.

Rather than pasting credentials directly, describe what you want to build and Startbase will implement a secure setup using server-side functions and secret storage.

Row-level security (RLS)

RLS policies control which users can access or modify data in your database. Misconfigured rules are a common cause of data leaks. Startbase helps you review and configure RLS policies (see Cloud → Database) to ensure users only see and change the data they're authorized to access.

Code security review

Application code can introduce risks through improper input handling, insecure auth flows, or unsafe use of external services. Startbase analyzes generated code for common vulnerability patterns and provides recommendations, including an automatic scan before every publish.

Dependency audit

Third-party libraries are a common source of security risk. Run a Deep scan in Cloud → Security to check your project's npm dependencies for known vulnerabilities.