RETOOL SECURITY CHECKLIST | VIBEEVAL

Complete all critical items before deploying to production.

Critical (fix before launch)

• Configure resource permissions per group — default visibility is too broad.
• Audit query templates for SQL injection — string interpolation is unsafe by default.
• Use prepared statements with proper resource configuration.
• Restrict admin access — admins can read every resource credential.
• Enable SSO and disable password auth.

High (fix in the first week)

• Enable audit logging on resource access.
• Configure release management — no direct edits in production.
• Restrict resource credentials by environment.

Medium (fix when you can)

• Document which apps connect to which resources.
• Pin Retool version (self-hosted).
• Set up backup of Retool config.

How to verify

Walk the list once, then re-scan. Manual checks miss regressions when an AI assistant regenerates code or someone merges a config change. The fastest way to confirm the fix actually held is to point a scanner at the deployed app — that’s what VibeEval automates for Retool apps.

Related Resources

How to Secure Retool

Step-by-step security guide.

Is Retool Safe?

In-depth security analysis.

Automate Your Checklist

Let VibeEval scan your Retool apps automatically.