Baseline

• Use TLS and close unnecessary ports

• Separate administrator accounts and enable 2FA

• Use unique secrets and rotate after incidents

• Patch OS, runtime, database and dependencies

• Restrict database, filesystem and backup permissions

• Review audit logs and anomalous activity

Privacy by design

• Collect only necessary data for stated purposes

• Separate essential processing from analytics/marketing consent

• Define retention and erase expired data

• Provide access, correction, export and erasure channels

• Do not post personal data in public forums or logs

Report a vulnerability

Email [email protected] privately with product, version, impact and reproduction steps. Do not post tokens, customer data or working exploits in the public forum.