HOW TO SECURE RENDER - SECURITY GUIDE | VIBEEVAL

Render Security Context

Render is a Heroku-style PaaS — push code, get an app. The platform handles TLS, basic DDoS, and OS patching. Your residual surface lives in: env vars and Environment Groups (the secrets store), Private Services (which you have to opt into for internal-only services), and the managed Postgres / Redis (which use connection strings you must keep out of code). The recurring incident shape is “I made my backend a Web Service instead of a Private Service, anyone can hit it directly.”

Security Checklist

1. Use Environment Groups for shared secrets

Dashboard → Environment Groups: create a group per environment (prod-secrets, staging-secrets). Reference from each service. Never hardcode secrets in render.yaml or Dockerfile. The group is read by the service at deploy and at runtime; the values never enter git.

2. Configure Private Services for internal-only services

For backend APIs that only your other Render services should reach: deploy as Private Service, not Web Service. Private Services are reachable only from inside your Render private network at <service>.<region>.private. Web Services have a public *.onrender.com URL — fine for the frontend, wrong for the internal API.

3. Secure managed Postgres

For Render Postgres: enable the encrypted connection (?sslmode=require in the connection string). Use the Internal Database URL (private network) instead of the External Database URL (public, IP-allowlisted) wherever possible. Rotate the password after any team-member departure: Database → Settings → Reset Password.

4. Enforce HTTPS

Service → Settings → Custom Domain: confirm cert is provisioned. Settings → Auto-Redirect HTTP → HTTPS: on. Test by hitting http://yourdomain.com and confirming the redirect.

5. Configure health checks

Service → Settings → Health Check Path: set to /health (or your equivalent endpoint that returns 200 only when the app is functional). Failed health checks trigger restarts — limits the lifespan of a wedged or compromised process.

6. Configure team permissions

Team → Members: review quarterly. Owner / Admin / Member / Viewer. Admin can deploy and read env vars — keep the list small. Remove ex-team members same-day; rotate sensitive secrets after departure.

7. Audit build logs for leaked secrets

Service → Events → [deploy] → Logs: search for known secret prefixes. A common bug ships when a build script console.logs the env, dumping secrets into logs that team members can read.

8. Configure auto-scaling limits

Service → Settings → Scaling: set explicit min and max instances. Auto-scaling unbounded is a DoS amplifier — an attacker triggers growth, you pay.

9. Verify DDoS / WAF

Render provides basic DDoS protection. For larger sites, front with Cloudflare or another CDN/WAF. Confirm origin IPs aren’t reachable directly (otherwise the WAF is bypassable).

10. Audit cron jobs

Cron Jobs → [job] → Settings: review what each job does and what env vars it has access to. Jobs run without a user context — they should be system-level operations, not “log in as user X and do things.”

11. Configure disk encryption

For services with persistent disks: encryption at rest is on by default — verify in the disk’s settings. For sensitive data, layer additional client-side encryption.

12. Set up backups

Render Postgres has automated backups; for free tier, daily; for paid, also point-in-time recovery. Database → Backups: confirm retention matches your requirement. Test restore once before you need it.

13. Review network policies

For Private Services to reach external services (Stripe, OpenAI, etc.): outbound goes through Render’s egress IPs. For inbound: pin to known IPs where possible (admin endpoints, health-check probes).

14. Enable audit logging

Team Settings → Audit Logs: track deploys, env-var changes, member additions, OAuth integrations. Useful for incident response.

15. Configure monitoring

Render’s built-in metrics show CPU / memory / response time. For deeper observability, integrate Datadog or your platform of choice. Alert on: 5xx error rate spikes, sustained high CPU, unusual outbound traffic.

16. Run a security scan

The full VibeEval scan probes your deployed Render app for missing auth, BOLA, and webhook trust.

Related Resources

Free Self-Audit Suite

Five free scanners.

Vibe Coding Security Risk Guide

Full risk catalogue.

PostgreSQL Guide

Secure your Render Postgres deployment.

Automate Your Security Checks

VibeEval scans applications hosted on Render for missing auth, BOLA, and exposed admin endpoints.