Security baseline

Host and network

Use SSH keys, restrict administration ports, patch the host, enable MFA on deployment consoles, and do not publish PostgreSQL or Redis to the internet.

Application

Force HTTPS, disable debug mode, validate trusted hosts and proxies, enforce server-side permissions, rate-limit public authentication and collection endpoints, and use secure cookies.

Integrations

Use service accounts or dedicated scoped tokens. Store provider secrets only in a secret manager or protected environment configuration.

Operations

Log security-relevant actions, retain audit evidence, protect backups, and maintain a tested incident and credential-rotation process.