Security baseline

Enforce HTTPS/HSTS in production.
Keep private/verification uploads outside public storage; authorize every download.
Validate MIME and image decoding; strip metadata where appropriate.
Use policies for every tenant-owned resource.
Enable 2FA for admin/DJ accounts.
Verify Stripe webhook signatures and make handlers idempotent.
Rate-limit auth, enquiry, review and messaging endpoints.
Audit privileged actions; hash IP addresses if retained.
Never store card details.
Run queues under Supervisor/systemd and keep dependencies patched.
Replace placeholder legal policies before launch.