5-Minute Security Quick Wins

Check Your .gitignore (2 min)

Make sure sensitive files don't get committed to git. Your .gitignore should include:

.env
.env.local
.env.*.local
node_modules/
*.log
.DS_Store

How to check: Open your .gitignore file and verify .env is listed. If the file doesn't exist, create one in your project root.

High Impact

Verify .env Isn't Committed (1 min)

Even with a proper .gitignore, your .env file might have been committed before you added the ignore rule.

git log --all --full-history -- .env

If this shows any results, your .env file was committed at some point. You'll need to rotate all secrets in that file immediately.

High Impact

Confirm HTTPS is Enabled (1 min)

Visit your production site and check the URL bar. You should see a lock icon and https:// at the start of the URL.

If using Vercel or Netlify: HTTPS is automatic. Just verify by visiting your site.

If self-hosting: Set up SSL with Let's Encrypt or your hosting provider's SSL option.

High Impact

Remove Debug Logging (3 min)

Search your codebase for console.log statements that might expose sensitive data:

// Bad - exposes user data
console.log('User data:', user);
console.log('API response:', response);

// Better - remove in production or use proper logging
if (process.env.NODE_ENV === 'development') {
  console.log('Debug info');
}

Search for console.log in your code and remove any that log sensitive data like user info, tokens, or API responses.

Medium Impact

Add Basic Security Headers (5 min)

If you're using Next.js, add these headers to your next.config.js:

// next.config.js
const securityHeaders = [
  { key: 'X-Content-Type-Options', value: 'nosniff' },
  { key: 'X-Frame-Options', value: 'DENY' },
  { key: 'X-XSS-Protection', value: '1; mode=block' },
];

module.exports = {
  async headers() {
    return [{ source: '/:path*', headers: securityHeaders }];
  },
};

For other frameworks, check your framework's documentation for adding HTTP headers.

Medium Impact

Update Dependencies (2 min)

Check for known vulnerabilities in your dependencies:

npm audit

If vulnerabilities are found, try to fix them with:

npm audit fix

Note: Some vulnerabilities require manual updates if they involve breaking changes. Prioritize Critical and High severity issues.

Medium Impact

Check for Hardcoded URLs (3 min)

Search for hardcoded localhost or development URLs that might have made it to production:

// Bad - hardcoded development URL
const API_URL = 'http://localhost:3000';

// Good - use environment variable
const API_URL = process.env.NEXT_PUBLIC_API_URL;

Search your codebase for localhost and 127.0.0.1 to find any hardcoded development URLs.

Medium Impact