Admin Security Checklist

Audit an admin panel on Vercel, from sign-in to revocation, and find the real gaps.

17 checks45 minutes

From the guide How to Secure an Admin Panel: Google Auth, 2FA, and Sessions on Vercel

Most admin breaches are not exotic: a missing role check, a token in browser storage, an unguarded URL. These checks close them in the order an attacker would try them.

01Who gets in

Move the admin to its own subdomain as a separate Vercel projectA shared domain lets a scripting bug on the public site ride the admin session.
Give the admin its own env vars and a least-privilege database roleShared secrets and roles mean one leak in the public app exposes everything the admin can touch.
Check a verified email against an explicit allowlist in the signIn callbackGoogle proves who someone is, not that they should run your business.
Store each admin's role in your own database, not the Google profileWithout your own role record, you cannot decide or change what each admin is allowed to do.
Require a passkey or security key, and avoid SMS codes for adminsApp codes can be phished and SMS can be SIM-swapped, while a passkey is bound to your domain.
Re-prompt for the second factor before refunds, exports and role changesOne hijacked session could otherwise drain funds or export every customer record at once.

Admin Security Checklist

01Who gets in

02Sessions and server checks

03Perimeter and response

The rest of the kit is one step away.