Pre-launch security checklist

A minimum checklist to run through before taking a SITESAFF site to production.

Infrastructure

Secrets only via environment variables, HTTPS enforced, and rate-limiting on public endpoints.

Application

Rotate the default admin password, enable 2FA for admin accounts, and confirm CORS only allows valid domains.