What is least privilege?
Least privilege means every person, app and key gets only the access it needs to do its job, and no more. A key that only needs to read products shouldn't be able to delete users.
Also called: Principle of least privilege
ON THIS PAGE
What it means
When something goes wrong, such as a leaked key or a hijacked account, the damage is limited by what that key or account was allowed to do. A small permission means a small problem.
In practice it means read-only keys where possible, separate keys for separate jobs, restricted database roles, and admin rights for as few people as possible.
Why it matters for vibe-coded apps
AI tools usually pick the most powerful key or setting because it removes errors fastest. That works today and turns a small leak into a total breach later.
- One leaked key can give access to everything, not just one feature.
- Mistakes by a helper, script or AI agent have a bigger blast radius.
- Powerful keys are harder to rotate because so much depends on them.
Example
A reporting script that only reads data.
const db = connect(process.env.ADMIN_DATABASE_URL); // can change or delete anything-- one-time setup
create role reporting login password '...';
grant select on public.orders to reporting;
// in the script
const db = connect(process.env.READONLY_DATABASE_URL);Ask of every key and account: what is the least it needs to do, and can I narrow it to that?
How to check if your app has this problem
- 1List your keys and database logins, and write what each one actually needs to do.
- 2Check whether any front-end or script code uses an admin or service key.
The quicker way: LetMeCheck tests for this automatically, from the outside, the way an attacker would.
Run a free scan →How to fix it
- 1Create narrower keys, such as read-only or single-service ones, for each job.
- 2Replace admin keys in scripts and front ends with the narrow ones.
- 3Remove access for people and tools that no longer need it.
- 4Review permissions every few months.
Review the keys and database roles my app uses. For each one, tell me what it can do versus what it needs, and replace over-powerful keys with read-only or restricted ones where possible.
Check if your app has this problem
Paste your website and we'll check for least privilege issues and other common issues in AI-built apps. Free, about a minute, and nothing on your site is changed.
Last updated
Related terms
- Service role keyA Supabase key that skips every security rule, meant only for your server.
- Key rotationReplacing a secret key with a new one and switching off the old one.
- Row level securityA database setting that decides which rows each user can see or change.
- YOLO modeLetting an AI coding tool run commands and edit files without asking you first.
Need help?
Not sure what this means for your app? Our team will explain it in plain English.