Overview
Security is critical for any production app handling user data. This section covers essential security practices for Launch applications.Prerequisites
- Production environment configured
- Access to deployment logs and secrets manager
Mobile Security
Secure storage, data protection, and device security
Security Checklist
Pre-launch security review checklist
Built-in Security Features
Launch includes these security features out of the box:Security Principles
Never trust client input
Never trust client input
Always validate and sanitize all data coming from the client, even if it
seems to come from your own app.
Principle of least privilege
Principle of least privilege
Only request permissions you need. Only expose data the user should access.
Defense in depth
Defense in depth
Multiple layers of security. If one fails, others still protect.
Keep secrets secret
Keep secrets secret
Never commit secrets to git. Use environment variables and secret managers.
Steps
Quick Security Wins
1
Enable HTTPS
Ensure your production API uses HTTPS only
2
Set secure headers
Add security headers to your API responses
3
Rate limit auth endpoints
Prevent brute force attacks on login
4
Validate all inputs
Use Zod schemas for every API endpoint
5
Audit dependencies
Run
pnpm audit regularlyTroubleshooting
- Leaky logs: review logging config and sanitize inputs
- Auth failures: verify provider env vars and callback URLs