What are Retool security best practices?

The best practices specific to Retool (not generic OWASP)

Every "security best practices" list tells you to use HTTPS and rotate keys. Those are table stakes. The list below is what actually matters for Retool apps, based on the risks that appear in real Retool deployments.

1. Scan your deployed application with a security tool that understands this stack

*Why:* A common failure mode in Retool applications: resource connection security. Left unchecked, this can lead to data exposure, unauthorized access, or service abuse. *Do this:* Scan your deployed application with a security tool that understands this stack. Address the specific findings — generic best practices don't catch platform-specific misconfigurations.

2. Use parameterized queries, sanitize all user input, and render dynamic content with framework escaping (React JSX, not dangerouslySetInnerHTML)

*Why:* A common failure mode in Retool applications: query parameter injection. Left unchecked, this can lead to data exposure, unauthorized access, or service abuse. *Do this:* Use parameterized queries, sanitize all user input, and render dynamic content with framework escaping (React JSX, not dangerouslySetInnerHTML).

3. Enable Row Level Security (Supabase) or Security Rules (Firebase) on every table

*Why:* A common failure mode in Retool applications: access control configuration. Left unchecked, this can lead to data exposure, unauthorized access, or service abuse. *Do this:* Enable Row Level Security (Supabase) or Security Rules (Firebase) on every table. For custom backends, enforce authorization at the query layer — never client-side.

4. Enable audit logging for all data access and admin operations

*Why:* A common failure mode in Retool applications: audit logging requirements. Left unchecked, this can lead to data exposure, unauthorized access, or service abuse. *Do this:* Enable audit logging for all data access and admin operations. Retain logs per your compliance requirements (7 years for SOX, indefinite for some PCI scenarios).

Retool-specific: audit every table for RLS before every deploy

The failure mode in Retool + Supabase apps is always the same: a table gets added during a feature push, RLS never gets turned on, the full table becomes queryable via the anon key. Bake a pre-deploy check: `select tablename from pg_tables where schemaname = 'public' and not rowsecurity` — the result must be empty.

Verification

Even perfect best practices don't prove themselves — the only way to confirm the list above is implemented is to scan a deployed Retool app. VAS probes each of resources, queries, access control, audit logs by actually attempting the attack, not just reading headers or docs.