# Security baseline
- Enforce HTTPS/HSTS in production.
- Keep private/verification uploads outside public storage; authorize every download.
- Validate MIME and image decoding; strip metadata where appropriate.
- Use policies for every tenant-owned resource.
- Enable 2FA for admin/DJ accounts.
- Verify Stripe webhook signatures and make handlers idempotent.
- Rate-limit auth, enquiry, review and messaging endpoints.
- Audit privileged actions; hash IP addresses if retained.
- Never store card details.
- Run queues under Supervisor/systemd and keep dependencies patched.
- Replace placeholder legal policies before launch.