updates for admin area

2026-09-12 20:45:05 +01:00
parent 0704924aa8
commit 8c9dbfee08
50 changed files with 1337 additions and 152 deletions
@@ -0,0 +1,12 @@
+# Security baseline
+- Enforce HTTPS/HSTS in production.
+- Keep private/verification uploads outside public storage; authorize every download.
+- Validate MIME and image decoding; strip metadata where appropriate.
+- Use policies for every tenant-owned resource.
+- Enable 2FA for admin/DJ accounts.
+- Verify Stripe webhook signatures and make handlers idempotent.
+- Rate-limit auth, enquiry, review and messaging endpoints.
+- Audit privileged actions; hash IP addresses if retained.
+- Never store card details.
+- Run queues under Supervisor/systemd and keep dependencies patched.
+- Replace placeholder legal policies before launch.