Security checklist
The primary aim of this checklist is to assist you in building apps that exemplify best-practice security measures. Covering a spectrum of considerations, the checklist addresses areas from environment configuration, roles, and permissions, to scripts embedded within coded components. Depending on the diverse building blocks you've employed, some checkpoints might be optional, offering flexibility within the framework while maintaining security standards.
Roles
Built-in roles
Most Appfarm Create users have at least one of the built-in roles: Owner, Maintainer, or Developer, which defines their basic access rights. In the Development environment, the built-in roles describe access to apps, services, and object classes, as well as modification of user accounts, updating app secrets, etc. The built-in roles, however, do not have access to Test, Staging, or Production. To access a client app in these environments, you must have a custom role with the necessary permissions.
Custom roles
All users with access to your apps should be members of at least one custom role. Roles should have descriptive names and clear descriptions.
Learn more about how to add users and assign roles.
Permissions
When setting permissions, operate with the principle of least privilege in mind: all users are given the minimum levels of access – or permissions – needed to perform their job functions. Collaborate on a permissions model together with your stakeholders to leave out any doubts about access control.
Secrets
Secrets are a storage mechanism for sensitive values. All secrets within your app should have descriptive names and a clear description of the secret's purpose. Where possible, secrets should be environment-specific to minimize the damage in case of a potential attack. If, for some reason, users have permission to delete but not to create or edit secrets, consider locking the secret to reduce the risk of unwanted changes.
Service accounts
All service accounts should have descriptive names and a clear description of the secret's purpose. Select a relevant role for the service account. Where possible, each service account should have a separate role granting only the necessary permissions.
Create user account
On creation, all users should be assigned a suitable role granting correct permissions.
Login config and Custom Auth
Logs
Review logs regularly as a pre-emptive measure to check if any irregularities occur, as well as in case of any problems being reported, in order to debug. Logs should be disabled in Staging and Production unless they are being used for an ongoing debugging process.
Snapshots
Backups are important. A snapshot is a copy of your solution model at a certain point in time.
A snapshot procedure should be in place to minimize the risk of functionality loss in case of unwanted changes or irreparable errors.
Service endpoints
API keys for service accounts
Environment configurations
Make sure only to enable what you need.
Testing
App data quality
Last updated
Was this helpful?