updates for admin area

2026-09-12 21:29:34 +01:00
parent 2964762c4b
commit 8b6d07b8f6
10 changed files with 241 additions and 10 deletions
@@ -0,0 +1,12 @@
+# Security baseline
+- Enforce HTTPS/HSTS in production.
+- Keep private/verification uploads outside public storage; authorize every download.
+- Validate MIME and image decoding; strip metadata where appropriate.
+- Use policies for every tenant-owned resource.
+- Enable 2FA for admin/DJ accounts.
+- Verify Stripe webhook signatures and make handlers idempotent.
+- Rate-limit auth, enquiry, review and messaging endpoints.
+- Audit privileged actions; hash IP addresses if retained.
+- Never store card details.
+- Run queues under Supervisor/systemd and keep dependencies patched.
+- Replace placeholder legal policies before launch.