updates

2026-09-12 20:22:45 +01:00
parent 35d3f344c8
commit 0704924aa8
3 changed files with 2 additions and 30 deletions
@@ -1,12 +0,0 @@
-# Security baseline
- Enforce HTTPS/HSTS in production.
- Keep private/verification uploads outside public storage; authorize every download.
- Validate MIME and image decoding; strip metadata where appropriate.
- Use policies for every tenant-owned resource.
- Enable 2FA for admin/DJ accounts.
- Verify Stripe webhook signatures and make handlers idempotent.
- Rate-limit auth, enquiry, review and messaging endpoints.
- Audit privileged actions; hash IP addresses if retained.
- Never store card details.
- Run queues under Supervisor/systemd and keep dependencies patched.
- Replace placeholder legal policies before launch.