# Security Checklist

- [ ] Rotate the DB password after installation because it was shared in chat.
- [ ] Keep `.env` outside `public_html`.
- [ ] Keep `vulaprize-app` outside `public_html`.
- [ ] Set `APP_DEBUG=false` in production.
- [ ] Keep `REAL_MONEY_ENABLED=false` until PayFast sandbox and legal review are complete.
- [ ] Use HTTPS only.
- [ ] Create a strong root admin password.
- [ ] Delete any temporary setup scripts after use.
- [ ] Restrict writable permissions to storage/upload folders only.
- [ ] Test support ticket lock, duplicate guesses, webhook idempotency and KW transactions before launch.