What are Fly.io security best practices?

The best practices specific to Fly.io (not generic OWASP)

Every "security best practices" list tells you to use HTTPS and rotate keys. Those are table stakes. The list below is what actually matters for Fly.io apps, based on the risks that appear in real Fly.io deployments.

1. Move all secrets server-side (environment variables, serverless functions)

*Why:* A common failure mode in Fly.io applications: secrets synchronization across regions. Left unchecked, this can lead to data exposure, unauthorized access, or service abuse. *Do this:* Move all secrets server-side (environment variables, serverless functions). Rotate any keys previously in frontend code. Audit bundles for leftover credentials before each deploy.

2. Scan your deployed application with a security tool that understands this stack

*Why:* A common failure mode in Fly.io applications: edge deployment security. Left unchecked, this can lead to data exposure, unauthorized access, or service abuse. *Do this:* Scan your deployed application with a security tool that understands this stack. Address the specific findings — generic best practices don't catch platform-specific misconfigurations.

3. Scan your deployed application with a security tool that understands this stack

*Why:* A common failure mode in Fly.io applications: private networking configuration. Left unchecked, this can lead to data exposure, unauthorized access, or service abuse. *Do this:* Scan your deployed application with a security tool that understands this stack. Address the specific findings — generic best practices don't catch platform-specific misconfigurations.

4. Scan your deployed application with a security tool that understands this stack

*Why:* A common failure mode in Fly.io applications: volume and persistence security. Left unchecked, this can lead to data exposure, unauthorized access, or service abuse. *Do this:* Scan your deployed application with a security tool that understands this stack. Address the specific findings — generic best practices don't catch platform-specific misconfigurations.

Fly.io-specific: audit every table for RLS before every deploy

The failure mode in Fly.io + Supabase apps is always the same: a table gets added during a feature push, RLS never gets turned on, the full table becomes queryable via the anon key. Bake a pre-deploy check: `select tablename from pg_tables where schemaname = 'public' and not rowsecurity` — the result must be empty.

Verification

Even perfect best practices don't prove themselves — the only way to confirm the list above is implemented is to scan a deployed Fly.io app. VAS probes each of secrets config, network security, app security, headers by actually attempting the attack, not just reading headers or docs.