updates for admin area

2026-09-12 21:21:03 +01:00
parent 5e2f4a1fa7
commit 2964762c4b
3 changed files with 0 additions and 70 deletions
@@ -1,12 +0,0 @@
-# Security baseline
- Enforce HTTPS/HSTS in production.
- Keep private/verification uploads outside public storage; authorize every download.
- Validate MIME and image decoding; strip metadata where appropriate.
- Use policies for every tenant-owned resource.
- Enable 2FA for admin/DJ accounts.
- Verify Stripe webhook signatures and make handlers idempotent.
- Rate-limit auth, enquiry, review and messaging endpoints.
- Audit privileged actions; hash IP addresses if retained.
- Never store card details.
- Run queues under Supervisor/systemd and keep dependencies patched.
- Replace placeholder legal policies before launch.