Security Checklist for AI-Coded Analytics & Data Apps

A production security checklist for builders shipping AI-coded analytics and data apps - dashboards, data tools and SQL/LLM agents written with Cursor or Claude Code. 120 items across 13 categories, distilled from real production hardening of 20+ live microservices. Each item gives the risk, a plain-English fix, and working code.

It is organized by layer. Pick a category on the left (or from the list below) to see its items - the biggest categories are Frontend, Backend and Perimeter/Edge; the whole thing is searchable and every item has its own permalink.

Written for a mixed audience: each item leads with plain language and an everyday example before the technical specifics, so a non-engineer can grasp what the risk is and why it matters, while the code fix stays fully technical.

• React Frontend Security26 itemsSecuring the React + Vite app and its Vercel serverless proxies: security headers, CSP, CORS, rate limiting, auth, and safe handling of secrets and user input.
• FastAPI Backend Security20 itemsHardening the FastAPI services: input validation, authentication, rate limits, safe error handling, logging hygiene, and streaming-safe middleware.
• Database Layer Security (Postgres)7 itemsProtecting the Postgres layer: least-privilege roles, parameterized queries, row-level security, backups, and safe connection handling.
• DuckDB-Specific Security6 itemsDuckDB-specific risks: read-only attach, query and resource limits, file-path safety, and containing what an analytical SQL surface can reach.
• Perimeter and Edge Protection (Cloudflare)14 itemsCloudflare edge protection: WAF, rate limiting, bot and abuse controls, and keeping the origin off the open internet.
• Infrastructure Security5 itemsInfrastructure hygiene: environment isolation, secrets management, safe deploys, and least-privilege service credentials.
• Incident Response4 itemsBeing ready when something goes wrong: logging, alerting, an incident playbook, and safe rollback.
• MCP Security (fastapi-mcp)4 itemsSecuring MCP (Model Context Protocol) servers: authentication, scoping what an AI agent can call, and rate/abuse limits on tool endpoints.
• Server Security (VPS / Self-Hosted)5 itemsVPS and self-hosted server hardening: SSH, firewall, fail2ban, patching, and least-privilege OS users.
• Authentication and Authorization11 itemsAuthentication and authorization: session and JWT handling, brute-force protection, and enforcing who can do what.
• Supply Chain (Dependencies + CDN)8 itemsSupply-chain safety: pinning dependencies, vetting packages, CDN integrity, and reducing what a compromised dependency can reach.
• Self-Hosted and Third-Party Apps3 itemsSelf-hosted and third-party apps: gating admin UIs behind auth, and safe defaults for tools you run but did not build.
• Monitoring, Observability and Alerting7 itemsWatching every layer and getting alerted the moment something breaks: layered monitoring, real-path liveness probes, a tiered alerting system, a public status page with zero database exposure, and a two-tier automated-plus-human review.

Every item comes from hardening real, live services (React on Vercel, FastAPI on VPS/OCI, Postgres and DuckDB behind Cloudflare, plus MCP servers for AI agents). The list grows as new attack patterns show up in the logs. Each category page has a "Copy page" button for handing the checklist straight to an AI coding agent, and every item can be copied on its own.

For AI agents: the full machine-readable checklist is at /ai/apps/security-checklist-full.md, and each category has a Markdown twin at /security/{category}.md.