Tagged: security
Pages with this tag
2 · Server sync — capture server changes
1Capture untracked server / admin-panel changes (uploads, installer output, config) back into git with WF-SYNC before a deploy overwrites them — reviewing the file list first and never staging secrets.
6 · Commit & secure
2Commit the repo-safe installer artifacts, document any author patches in the shipped vendor tree, verify deploy symlinks and shared_files, then lock down /install and /update with layered defense.
6 · Cloudflare CDN
3Front the app with Cloudflare on the Free plan — nameserver cutover, API-driven DNS, Full (Strict) SSL + HSTS, WAF and rate limiting, cache rules, DNSSEC, and a final API verification probe. Rocket Loader stays OFF for Laravel.
8 · Deep codebase audit
4A non-production deep audit of the codebase — project structure, composer security audit, Git hygiene, FVDUT storage persistence, secret + debug-code scans (with the word-boundary fix for dd()), storage-tracked-file triage, CodeCanyon frontend anti-patterns, and an optional schema audit.
3 · Credentials & branding
5Lock the admin account first (default superadmin@example.com / 123456 is publicly known), generate and upload a coherent brand asset kit, resolve the correct PHP binary for every SSH command, then audit and replace the vendor's seeded demo content before any public URL goes live.
Phase 7 · Security & monitoring
6Harden the deployed app (rotate vendor defaults, TLS/HSTS, security headers, rate limits, session/mass-assignment audit), add an audit trail, then make it observable — off-server backups, Sentry, uptime, logs — and close out the legal layer (GDPR, cookie consent) and compliance tracks (SOC 2 / HIPAA).
1 · Harden first
7Treat every shipped secret as compromised — rotate vendor defaults, lock down file permissions, throttle sensitive endpoints, and audit mass assignment + session cookies before anything watches the app.
2 · Security headers & packages
8Enforce HTTPS with HSTS + the standard header set in .htaccess, back it with a SecurityHeaders middleware, force HTTPS in production, encrypt high-risk PII fields, and require strong passwords — for Grade A at securityheaders.com (unsafe-inline caps at A until CSP nonces/hashes).
3 · Activity logging
9Give security-relevant events a durable audit trail — install Spatie Activity Log, capture model changes, log auth and GDPR actions, and auto-prune old records so an incident always has a paper trail.
2 · Security audit
10The full security pass — header grading, ownership-aware vulnerability decisions, blocked sensitive files, admin + storage hardening, and a vulnerability register.
1 · Technical readiness (MUST)
11Transfer Phase 10 audit deferrals into the root Zaj-BACKLOG.md, then run the seven MUST gates that verify the launch-candidate system against reality — git/deploy verification, codebase + security scan, database confidence, env audit, end-to-end testing, monitoring, and final signoff.
1 · Pre-flight security hygiene (P0)
12Never skip this — rotate every test-mode key and non-production password that touched a chat or log, migrate plaintext credentials into a secrets manager, re-scope over-privileged service accounts, and record the audit.