# Security launch checklist
- Change demo credentials.
- Move secrets to environment variables.
- Force HTTPS.
- Secure/HttpOnly/SameSite cookies.
- Rate-limit authentication, discovery, messages, reports and uploads.
- CSRF-protect state-changing endpoints.
- Validate/re-encode uploads and prevent execution.
- Enforce subscription entitlements server-side.
- Verify payment callbacks and idempotency.
- Authenticate/authorize WebSockets.
- Never expose exact GPS coordinates.
- Add moderation and appeals.
- Minimize identity-verification retention.
- Run SAST/DAST/dependency and penetration tests before launch.
