Fixing vulnerabilities: step-by-step remediation guide for developers
> TL;DR: How to implement fixes after a security audit. RLS code, authentication, API — concrete examples.
After the audit: action plan
Priority 1: Critical flaws — fix in 24-48h
Data accessible without authentication: add auth verification on every endpoint. In Supabase, create RLS policies. In Laravel, use auth middleware.
Unauthenticated webhooks: remove hardcoded URLs from frontend. Add HMAC signature verification.
Priority 2: High flaws — fix in 1 week
Privilege escalation: verify not just authentication but authorization (does THIS user have rights to THIS resource?).
Priority 3: Medium flaws — fix in 2 weeks
Security headers: add CSP, X-Frame-Options, HSTS.
Rate limiting: limit login attempts, API calls, account creation.
Key Takeaways
Building software? CleanIssue performs security audits for your product in real-world conditions, no source code access needed. For a first read of your exposure, start with an external review of your application.
Related articles
Three adjacent analyses to keep exploring the same attack surface.
Secrets in Git: the API key you deleted is still there
Deleting an API key from your code doesn't remove it from Git history. How attackers scan repositories, why that .env committed in 2023 is still exploitable, and what to do — in the right order.
Supabase RLS: the 5 mistakes we find in every product audit
Supabase Row Level Security policies are powerful but deceptive. Here are the most common mistakes we encounter when auditing SaaS applications.
MFA in SaaS products: why 62% of French vendors still don't offer it
Multi-factor authentication is a standard. Yet the majority of French SaaS products don't offer it to their users. Analysis of barriers and solutions.
Sources
Editorial analysis based on official vendor, project, and regulator documentation.
Related services
If this topic maps to a real risk in your stack, these are the most relevant CleanIssue audits.