SaaS dashboard security checklist

• Authorisation is org-scoped and deny-by-default: RLS on every org table plus requirePermission() on every route and server action; IDs from the client are always re-checked against org_id (no IDOR); cross-tenant access tests run in CI.
• An org can never be left without an owner: demoting, removing or deleting the last owner is rejected in code and by a database constraint trigger.
• Sessions use Better Auth with httpOnly SameSite cookies, CSRF-safe server actions, re-authentication for billing, API key and member-role changes, and session revocation on role change.

• API keys and webhook secrets are random 256-bit values shown once; keys stored only as SHA-256 hashes, webhook secrets encrypted at rest; never logged; revocation takes effect within 30 s; scopes cannot exceed the creator's role.

• Outbound webhook URLs must be https, resolve to public IPs only (block private, loopback, link-local and metadata ranges), no redirects followed, re-validated at delivery time to defeat DNS rebinding.

• Member emails and names are personal data: stored once in users, referenced by id elsewhere, excluded from logs and audit meta (ids and hashed IPs only), exportable and erasable per user; org deletion purges tenant data after the grace period.

• Security-relevant actions (login, role change, key create/revoke, billing change, data export, org delete) always write audit_log in the same transaction; the app role cannot update or delete audit rows.

• GDPR (applies to EU users): Members' personal data needs a lawful basis, export and erase endpoints, a DPA template for B2B customers, a sub-processor list and retention limits on audit_log and usage_events.
• SOC 2 readiness (applies to selling to businesses): Immutable audit log, access reviews, least-privilege roles, backups and change history are the controls enterprise buyers ask for first.
• CCPA (applies to California users): Honour deletion and do-not-sell requests; analytics must not sell member data.

• webhook deliveries per org day: per-plan cap; over the cap deliveries are dropped to dead status and the org is notified.
• api requests per org month: per-plan quota enforced at the edge of the handler; over quota returns 429 before any work.
• storage mb per org: per-plan cap; presigned URLs refused at 100% of quota.
• emails per org day: capped by EMAIL_DAILY_CAP_PER_ORG; over the cap sends are refused, not queued.
• export jobs per org day: max 5 exports per org per day, each bounded by MAX_EXPORT_ROWS.

Forge64 gives every app its own Postgres database and runs a quality gate that flags unauthenticated writes and secrets in client code before you see the app. It does not replace your own testing, and it holds no third-party security certification today.

This is a reference design for the category, not a promise that every item is generated today. Built-ins such as email, background jobs, file uploads and search are coming soon, so anything here that needs them is something you add yourself for now.

• Sign in as two different users and try to open each other's records by changing the id in the address.
• Submit each form with an empty value, a very long value and a script tag, and check the result.
• Call each write endpoint without signing in and check that it refuses.

What is the biggest security risk in a SaaS dashboard?

Authorisation is org-scoped and deny-by-default: RLS on every org table plus requirePermission() on every route and server action; IDs from the client are always re-checked against org_id (no IDOR); cross-tenant access tests run in CI.

Does a SaaS dashboard have compliance obligations?

GDPR, if you have EU users: Members' personal data needs a lawful basis, export and erase endpoints, a DPA template for B2B customers, a sub-processor list and retention limits on audit_log and usage_events. This is a starting point, not legal advice.

Will Forge64 certify my app as secure?

No. Forge64 holds no third-party security certification today and does not certify apps. The checklist is a way to test your own app.

• How to build a SaaS dashboard
• SaaS dashboard architecture
• Example prompt for a SaaS dashboard
• SaaS dashboard scaling checklist
• Often combined: CRM
• Often combined: ledger app
• All app types