# Security and launch checklist

## 1. Critical production actions before public launch

- Rotate the default master admin password immediately.
- Change the default admin username if you want a less obvious admin identity.
- Replace the development JWT secret with a long random production secret.
- Ensure cookies are set with secure: true in production.
- Move from SQLite to PostgreSQL before any public or commercial exposure.
- Configure HTTPS and set a real domain via NEXT_PUBLIC_APP_URL.
- Disable or protect direct database access from non-admin users.
- Add a secrets manager for JWT_SECRET and database credentials.

## 2. Tenant isolation requirements

- Every database write must be scoped by tenantId.
- Any read or update operation must verify that the current user belongs to the same tenant.
- Prevent cross-tenant model or shoot visibility through strict query filters.
- Keep platform admin actions separate from tenant-scoped functions.

## 3. Input validation and API hardening

- Validate required fields in all POST/PUT routes.
- Reject invalid numeric conversions for prices and durations.
- Trim and normalize email and username inputs.
- Ensure slug generation avoids duplicates and unsafe characters.
- Check for existing records before creating a new tenant or user.
- Return 400/401/403/409 responses consistently.

## 4. Auth and session hardening

- Use strong password hashing (bcryptjs is already used in the app).
- Keep JWT_SECRET in a secure environment variable.
- Use httpOnly, sameSite, and secure cookie attributes.
- Set reasonable session expiry times.
- Consider adding refresh token support later if roles expand.

## 5. Media and file handling

- Do not accept arbitrary remote URLs for public file uploads without validation.
- Prefer S3 or Cloudinary for production media storage.
- Add size limits and MIME validation for image uploads.
- Consider a signed upload workflow for secure file delivery.

## 6. Data backup and recovery

- Schedule automatic PostgreSQL backups.
- Keep daily backups and retention policies.
- Validate restore procedures periodically.
- Store backup credentials separately from application secrets.

## 7. Audit logging and operations

- Log admin actions: tenant creation, user creation, contract changes, admin overrides.
- Log authentication attempts and failures.
- Record data mutations for auditability.
- Protect audit logs from modification by regular users.

## 8. Production monitoring

- Configure uptime monitoring and alerting.
- Monitor API response times and 5xx errors.
- Monitor database health and connection errors.
- Track failed login attempts and suspicious access patterns.

## 9. Release checklist

- Confirm tenant data separation works in a test environment.
- Test login and registration flows end-to-end.
- Test master admin onboarding and multi-tenant visibility.
- Verify contract and signature flow works in production-like conditions.
- Verify analytics and admin dashboards reflect real tenant data.
- Confirm gallery media loads correctly and no broken URLs remain.
- Confirm all environment variables are present on deployment.
- Review final content and copy for public-facing pages.

## 10. Recommended next-stage improvements

- PostgreSQL migration
- role-based permission matrix
- more granular audit logs
- file upload storage abstraction
- email notifications and reminders
- billing/subscription integration
- backup automation and disaster recovery drills