Eight security checks every indie dev should run before launching a SaaS app

A developer reviewing post-mortems of hacked indie SaaS products identified eight critical security gaps commonly missed before launch. The checklist targets apps built on stacks like Next.js and Supabase, where default configurations can leave API routes unprotected and user data exposed. Key vulnerabilities include unauthenticated API endpoints, broken object-level authorization that lets users access each other's data, and missing Content Security Policy headers. Each item on the checklist comes with a terminal command to detect the flaw and a short code fix to address it. The guide is aimed at solo developers shipping their first product who may lack formal security training or access to professional audits.