Content site security checklist

• Roles (owner|editor|author|contributor) gate every studio action server-side; authors edit only their own posts unless editor+; draft and scheduled posts are never reachable by slug without a signed preview token; all tables are RLS-scoped and gated bodies pass through canRead only.
• Paywall correctness: gated body is excluded from cached HTML, RSS, sitemap, search snippets and OG tags; entitlement comes from webhook-written memberships, checked on every gated request; cancelled members lose access at current_period_end; preview tokens expire.

• Editor content is a JSON document rendered by an allow-list serializer (no raw HTML nodes, iframes only from an allow-listed embed registry, links get rel attributes, javascript: URLs rejected); user comments are plain text; a strict Content-Security-Policy blocks inline script injection.

• Validate declared MIME, verify magic bytes, enforce size and pixel caps, re-encode every image in a sandbox with no network, strip EXIF/GPS, reject SVG upload (or sanitize to a safe subset), and serve media from a cookieless origin with X-Content-Type-Options: nosniff.

• Comment and signup abuse: Turnstile for anonymous and new users, honeypot, link and length caps, per-IP and per-user rate limits, moderation of first-time commenters, spam scoring, rel=ugc nofollow, and one-click removal with ban list.
• Newsletter abuse and cost control: double opt-in only, a hard daily and monthly send cap that refuses before sending, suppression list honored on every send, auto-pause on complaint or bounce thresholds, unsubscribe honored immediately, and rate limits on subscribe so the form cannot be used to mail-bomb third parties.
• Every billable resource has a code-enforced cap that fails closed: media storage and bytes per site, image processing minutes, newsletter sends per day and month, edge purges per minute, egress per plan, and comments per day; at the cap the operation is refused with a visible reason, never queued silently.

• Subscriber emails, memberships and comment identities are personal data: tokens stored hashed, IPs stored only as salted hashes, analytics cookie-less, consent timestamp and source kept, subscriber export and erase endpoints, and emails never appear in logs.

• SEO integrity: one canonical URL per page, noindex on drafts, previews, search results and tag pages below a minimum size, 301 for renamed slugs, no cloaking of paywalled content (use Paywalled-content structured data), and valid sitemaps.

• Preview, unsubscribe and webhook signing secrets and mailer credentials are env-only, rotated without downtime, never logged and never rendered to the client.

• GDPR / ePrivacy (applies to EU or UK readers): Subscriber emails and reader analytics are personal data: double opt-in with consent record, cookie-less analytics to avoid consent banners, unsubscribe in every email, export and erase for subscribers, and a processor agreement with the email provider.
• CAN-SPAM / CASL (applies to commercial email to US or Canadian recipients): Include sender identity and postal address, honest subject lines and a working unsubscribe honored within 10 days (immediately by design); CASL requires express or implied consent.
• Email deliverability rules (Gmail / Yahoo bulk sender) (applies to sending newsletters): SPF, DKIM, DMARC alignment, one-click unsubscribe (RFC 8058) and spam-complaint rate below 0.3% (target below 0.1%) are required for bulk senders.
• Copyright / DMCA and licensing (applies to user-contributed or multi-author content): Notice-and-takedown path for infringing content, license tracking for third-party images, and attribution fields.
• Sponsored content disclosure (applies to advertising or affiliate revenue): Label sponsored posts and affiliate links per FTC and local advertising rules.

• newsletter sends per day: NEWSLETTER_MAX_SENDS_PER_DAY; send_issue_batch refuses before a batch that would exceed it.
• newsletter sends per month: NEWSLETTER_MAX_SENDS_PER_MONTH per plan; scheduling refused when recipient_count would exceed the remainder.
• media storage gb: MEDIA_STORAGE_MB_PER_SITE per plan; presign refused at 100%.
• image processing minutes month: per-plan cap enforced before a process_image job is queued; metered into usage_events.
• cdn egress gb month: per-plan cap; large media variants refused over the ceiling while text pages stay served.
• edge purges per minute: EDGE_PURGES_PER_MINUTE; revalidate_paths coalesces and defers purges beyond it.

Forge64 gives every app its own Postgres database and runs a quality gate that flags unauthenticated writes and secrets in client code before you see the app. It does not replace your own testing, and it holds no third-party security certification today.

This is a reference design for the category, not a promise that every item is generated today. Built-ins such as email, background jobs, file uploads and search are coming soon, so anything here that needs them is something you add yourself for now.

• Sign in as two different users and try to open each other's records by changing the id in the address.
• Submit each form with an empty value, a very long value and a script tag, and check the result.
• Call each write endpoint without signing in and check that it refuses.

What is the biggest security risk in a content site?

Roles (owner|editor|author|contributor) gate every studio action server-side; authors edit only their own posts unless editor+; draft and scheduled posts are never reachable by slug without a signed preview token; all tables are RLS-scoped and gated bodies pass through canRead only.

Does a content site have compliance obligations?

GDPR / ePrivacy, if you have EU or UK readers: Subscriber emails and reader analytics are personal data: double opt-in with consent record, cookie-less analytics to avoid consent banners, unsubscribe in every email, export and erase for subscribers, and a processor agreement with the email provider. This is a starting point, not legal advice.

Will Forge64 certify my app as secure?

No. Forge64 holds no third-party security certification today and does not certify apps. The checklist is a way to test your own app.

• How to build a content site
• Content site architecture
• Example prompt for a content site
• Content site scaling checklist
• Often combined: SaaS dashboard
• Often combined: online store
• All app types