Security Notes

Security notes should stay practical and conservative.

Public Content

Visitors should only see public pages and public documentation.

Admin Content

Admin pages and controls must not be visible to visitors. No public signup should exist unless intentionally added later.

Never Commit

• Passwords.
• API keys.
• Access tokens.
• Discord webhook URLs.
• Private environment files.
• Production database credentials.

Good Habits

• Use environment variables for secrets.
• Keep admin access behind login.
• Use HTTPS in production.
• Review public docs before publishing.