Retool Security Checklist

Complete all critical items before deploying to production.

Critical (fix before launch)

Configure resource permissions per group - default visibility is too broad.
Audit query templates for SQL injection - string interpolation is unsafe by default.
Use prepared statements with proper resource configuration.
Restrict admin access - admins can read every resource credential.
Enable SSO and disable password auth.

High (fix in the first week)

Enable audit logging on resource access.
Configure release management - no direct edits in production.
Restrict resource credentials by environment.

Medium (fix when you can)

Document which apps connect to which resources.
Pin Retool version (self-hosted).
Set up backup of Retool config.

How to verify

Walk the list once, then re-scan. Manual checks miss regressions when an AI assistant regenerates code or someone merges a config change. The fastest way to confirm the fix actually held is to point a scanner at the deployed app - that’s what VibeEval automates for Retool apps.

How to Secure Retool

Step-by-step security guide.

Is Retool Safe?

In-depth security analysis.

Automate Your Checklist

Let VibeEval scan your Retool apps automatically.