Production preparation

• Use a supported and maintained operating system.
• Patch the server before production use.
• Use HTTPS for administrative and client-facing services.
• Restrict unnecessary inbound ports.
• Use scoped database credentials.
• Establish backups before production traffic.

Filesystem permissions

Application code should not be broadly writable. Only runtime locations that require write access should receive the corresponding controlled permissions.

Environment separation

Development, demo, test and production environments should remain separate. Production credentials should not be copied into public demos or distributable test packages.

Installer exposure

Temporary installation or migration routes should not remain unnecessarily accessible after deployment is complete.