Clerk pre-launch checklist
Defaults referenced come from Clerk's documentation, verified 2026-09-21, on the Clerk hub.
Secrets and keys
- CriticalNEXT_PUBLIC_ prefix on a secret
In your hosting dashboard (Vercel: Project, Settings, Environment Variables) or your
.envfiles, list every variable whose name starts withNEXT_PUBLIC_. - CriticalSecrets committed to the code repository
Open your project on GitHub (or the code view in your builder) and look at the file list for
.env,.env.local,.env.production,serviceAccountKey.jsonorfirebase-adminsdkfiles.
Data access
- CriticalRecord ids accepted without an ownership check
Create two accounts in your app and add one record, such as an order or a note, in each.
Login and permissions
- CriticalAdmin routes without any login check
Open a private browsing window so you are signed out.
- CriticalAuthorization enforced only in the browser
Sign in as a normal user and open developer tools (right-click, Inspect), then the Network tab.
- CriticalTokens trusted without server verification
Sign in, open developer tools (right-click, Inspect), go to the Network tab and pick a request to your own API that carries an Authorization header or a session cookie.
- CriticalRole chosen by the client at signup
Open your signup page, open developer tools (right-click, Inspect) and the Network tab, then submit the form with a test email.
- HighSessions that survive logout and password changes
Sign in, open developer tools (right-click, Inspect), go to the Network tab and use Copy as cURL on a request that returns your account data.
Payments
- HighPrice or plan taken from the client
Open your app's pricing page in Chrome, press F12 to open developer tools (the browser's built-in inspector), and select the Network tab.
- HighSubscription state trusted from local storage
Sign in to your app with a free account, press F12 to open developer tools, select the Application tab, then Local Storage on the left.
Questions
clerk security checklist
The list above: 10 checks across 4 categories, most severe first. Each links to a page with what the issue looks like, a self-check and a fix direction. Download the Markdown file to tick items off in your own notes.
can i use this checklist without buying anything
Yes. That is the point of publishing it. If you run every self-check and fix what you find, you have done most of what the security sweep does. What our test adds is a second account, scripts that enumerate everything, and a written report you can show someone.
Prefer someone else to run it: the security sweep covers the critical items in 24 hours; the pre-launch check covers the full list. Or run the self-check tool.