Antigravity

Antigravity Security Best Practices

Protect your Antigravity-built application with these essential security practices. From secret management to database security.

Verify your app follows these best practices automatically.

Antigravity makes building apps fast with AI assistance, but security requires intentional effort. These best practices will help you ship secure applications.

Quick Wins

Search codebase for 'sk-' and 'apiKey' to find exposed secrets
Enable RLS on all database tables immediately
Add .env to .gitignore before creating environment files
Run npm audit to find vulnerable dependencies
Test database access as an unauthenticated user

Security Best Practices

#1Move All Secrets to Environment Variables

critical

Antigravity-generated code may include API keys directly in source files. Move all secrets to server-side environment variables.

Implementation

Use your deployment platform's environment variable settings (Vercel, Netlify, etc.)

#2Enable Row Level Security (RLS) on All Tables

critical

Database RLS is your primary defense against unauthorized data access. Without RLS, anyone with the anon key can read all data.

Implementation

Enable RLS on each table and create policies that restrict access using auth.uid()

#3Review AI-Generated Authentication Code

critical

AI-generated auth code often has subtle vulnerabilities. Never accept authentication implementations without thorough review.

Implementation

Manually verify JWT handling, session management, and password hashing

#4Add Security Headers

high

Configure Content-Security-Policy, X-Frame-Options, HSTS, and other security headers.

Implementation

Add headers in your hosting configuration (Vercel, Netlify) or Next.js config

#5Validate All User Input Server-Side

high

AI-generated code often trusts user input. Always validate on the server.

Implementation

Use validation libraries like zod or joi for all incoming data

#6Disable Source Maps in Production

medium

Source maps expose your original code. Disable them before deploying.

Implementation

Set productionBrowserSourceMaps: false in your build config

Common Mistakes to Avoid

Leaving API keys in frontend code

Why it's dangerous:

Anyone viewing your JS bundles can extract these keys

How to fix:

Move all secrets to server-side environment variables

Deploying without RLS enabled

Why it's dangerous:

Your entire database is publicly accessible via the anon key

How to fix:

Enable RLS on all tables and write appropriate policies

Trusting AI-generated security code

Why it's dangerous:

AI prioritizes functionality over security best practices

How to fix:

Manually review all auth, validation, and access control code

Verify Your Antigravity App Security

Following best practices is the first step. Verify your app is actually secure with a comprehensive security scan.

Get Starter Scan

Frequently Asked Questions

How do I find hardcoded secrets in Antigravity code?

Search your codebase using grep: 'grep -r "sk-" .' for OpenAI keys, 'grep -r "sk_live" .' for Stripe. Also search for 'apiKey', 'secret', and 'password'. Move all found secrets to environment variables.

Does Antigravity configure database security automatically?

No. Like other AI coding tools, Antigravity creates functional code but skips security configuration. You must manually enable RLS on database tables and write policies.

What should I check before launching an Antigravity app?

1) All secrets in environment variables, 2) RLS enabled on all database tables, 3) Security headers configured, 4) Run a VAS security scan to catch anything you missed.

Last updated: February 2026