I built a personal web app for writing roleplay scenes. It uses BYOK (Bring Your Own Key) for services such as the database, and I would like to deploy it with Vercel so I can access it from multiple devices. My concern is that someone could discover an API endpoint, abuse an expensive operation, or otherwise cause a large hosting or service bill. I know no system is perfectly secure, but what practical steps should I take to reduce the risk?
4 Answers
If you prefer more control, a small VPS is another option. Use SSH keys instead of passwords, keep the operating system and packages updated, enable a firewall with only required ports, and consider Fail2Ban. Put the app behind Nginx with HTTPS from Let's Encrypt, and add an authentication layer in front of it. A managed server is easier but costs more; a bare VPS is not automatically safer because you are responsible for patching, backups, and responding to incidents.
Vercel can work well for this, but protect the operations that can create costs. Keep provider credentials and server secrets in Vercel Environment Variables, never in the browser or in source control. Require authentication and authorization on every API and database route, rather than only hiding buttons in the UI. Add per-user rate limits, request-size limits, timeouts, and quotas before making calls to paid services. Turn on spending alerts and limits wherever they are available, and use least-privilege database credentials. Also validate inputs, avoid exposing database connection strings, and log usage without recording secrets or private writing. Start small and monitor the deployment before expanding it.
For a personal app, you could also run it on a small always-on computer and connect to it through a private mesh VPN such as Tailscale. That avoids exposing the app publicly, but it means the machine, backups, updates, and remote access all become your responsibility. It is convenient if only you need access from your own devices.
Supabase Row Level Security and its public client key are fine when configured correctly, but the public key is not a secret. RLS must enforce access rules on every table, and sensitive actions should go through protected server-side functions. Encrypting a BYOK value in localStorage does not provide strong protection if the key used to decrypt it is also available to the browser; anyone who can run code in that page or use the browser session may be able to access it. For a personal app, avoid persisting the key when possible, or store it server-side only after adding proper authentication and encryption.
The goal is not to make an app magically impossible to break into. Good security makes attacks difficult and expensive enough that the app is not worth targeting, which is especially important when you are new to server administration.