How to do a security audit of a Gemini Code (Google) app?

Why a Gemini Code (Google)-specific audit (not a generic web audit)

A generic OWASP audit will tell you your Gemini Code (Google) app "needs CSP headers." A Gemini Code (Google)-aware audit tells you that your specific Gemini Code (Google) app has an RPC function callable without auth or a service key in a client bundle — the issues that actually appear when Gemini Code (Google) apps get compromised. The difference in output value is why the audit should be scoped to Gemini Code (Google)'s real failure modes.

Step 1 — Fingerprint the deployment

Confirm the Gemini Code (Google) stack components: database (firebase, supabase, postgres), hosting, auth provider, third-party integrations. For Gemini Code (Google) apps this is often visible in the Supabase endpoint URL in network requests. Document every component — each is an independent audit target.

Step 2 — Automated scan with Gemini Code (Google)-aware rules

Run VAS against the deployed URL. The scan probes the specific issue classes found in Gemini Code (Google) apps: injection scan, secrets scan, auth testing, service exposure. This is the 80/20 — most critical and high findings surface here. Fix anything critical before continuing to manual steps.

Step 3 — Manual Row Level Security (RLS) policies review

Open the Supabase dashboard → Authentication → Policies. For each table: is RLS enabled? Do policies check `(select auth.uid()) = user_id` or equivalent? Are there policies scoped to the anon role that shouldn't exist? The automated scan catches missing RLS; this step catches overly permissive RLS — a subtler but equally dangerous failure mode.

Step 4 — Authentication & authorization probing

Test every endpoint with no session (expect 401), with a valid session for a different user (expect 403 on user-owned resources), and with session tokens that have been tampered with (expect 401 if signatures are enforced). Rate limiting on login/password-reset is a pass/fail check here, not a nuance.

Step 5 — Re-scan to verify

Fix findings in severity order (critical → high → medium → low), re-scan after each batch of fixes. "I applied the fix" is not evidence — the fix might not have been deployed, might have been partial, or might have been reverted. Only the scan output proves the gap is closed. Log each finding + fix + verification scan for compliance records.

Gemini Code (Google)-specific checks often missed

• Command Injection Patterns
• Overly Broad GCP Permissions
• Hardcoded Google Cloud Credentials
• Exposed Internal Services