Netlify security checklist for AI-built apps

Static files and anything bundled into them are public. Netlify Functions are public endpoints by default: they receive a standard Request and any authorization is your code's job. Environment variables can be scoped to Builds, Post processing and Functions, and only the Functions scope keeps a value out of build output.

See our guides on client-side secrets and API authentication for the concepts. This page covers how to check them on Netlify.

Variables declared in netlify.toml get Builds and Post processing scope by default, so anything secret belongs in the site settings or CLI with only the Functions scope. A value with Builds scope can end up inlined into your bundle by your bundler.

Values set in netlify.toml take priority over site variables, then team-level shared variables, so check both places when a value is not what you expect.

netlify env:list
netlify env:list --plain --context production
grep -rnE "sk_live_|service_role|BEGIN PRIVATE KEY" dist build

Deploy Preview and Branch deploy contexts can hold different values from Production, and they should. Give them test keys.

For pull requests from forks and outside contributors, Netlify's default sensitive variable policy requires approval from a site member before the build starts. The other options are to deploy without sensitive variables or with no restrictions. Keep the default unless you have a reason. Site members' own commits always deploy without restriction.

To keep previews from being public, Netlify offers basic password protection on Pro plans and above, and team login with single sign-on on Enterprise plans. Check which applies to your plan.

Add a _headers file in the publish directory or a headers block in netlify.toml. Netlify documents that custom headers apply only to static files served from its own store, not to proxied content, functions or server-rendered pages. Those responses must set their own headers.

[[headers]]
  for = "/*"
  [headers.values]
    X-Frame-Options = "DENY"
    X-Content-Type-Options = "nosniff"
    Strict-Transport-Security = "max-age=31536000; includeSubDomains"
    Referrer-Policy = "strict-origin-when-cross-origin"
    Permissions-Policy = "geolocation=(), microphone=(), camera=()"

Every function is reachable at its path, either the default /.netlify/functions/name or a custom path from its config. Read secrets with Netlify.env.get inside the handler, verify a token or session before doing anything privileged, and derive the user from the verified token rather than the request body. Add rate limiting for functions that call paid APIs.

export default async (req: Request) => {
  const token = req.headers.get("authorization")?.replace("Bearer ", "");
  if (!token || !(await verifyToken(token, Netlify.env.get("JWT_SECRET")!))) {
    return new Response("Unauthorized", { status: 401 });
  }
  return new Response("ok");
};

Netlify detects forms by the data-netlify attribute and a form name. Submissions are filtered by Akismet automatically, and you can add a honeypot field or reCAPTCHA on top. For AJAX submissions, include the honeypot field in the POST body or it will not work. Do not collect sensitive personal or health information through a basic contact form.

<form name="contact" method="POST" data-netlify="true" netlify-honeypot="bot-field">
  <p hidden><label>Leave empty <input name="bot-field" /></label></p>
  <input name="email" type="email" required />
  <button type="submit">Send</button>
</form>

Headers should show on the page. The function call without a token should return 401 or 403. Read recent function logs and remove anything that prints tokens or request bodies.

curl -sI https://your-site.example.com | grep -iE "x-frame|x-content-type|strict-transport"
curl -i -X POST https://your-site.example.com/.netlify/functions/your-function
netlify logs function

• Putting API keys in netlify.toml, which gives them Builds scope.
• Expecting _headers to protect function responses.
• Using production credentials in Deploy Preview contexts.
• Assuming a function is private because the front end never links to it.
• Shipping forms with no honeypot or CAPTCHA.
• Turning off the untrusted deploy approval setting to speed up pull requests.

Re-run the variable listing, header check and no-token function calls after every change to netlify.toml or a function. Review each new function for its own authentication.