Skip to main content
Use this checklist with the complete Hardening Guide.

​
Release gate

  • Deploy a signed, pinned release; never use latest.
  • Run ./casebender preflight.
  • Publish only Nginx ports 80 and 443.
  • Use trusted TLS and redirect HTTP to HTTPS.
  • Keep PostgreSQL, Redis, OpenSearch, MinIO, API, ingestion, and processors on internal networks.
  • Store .env, encryption keys, and license material in an approved secret store with least-privilege access.
  • Preserve AUDIT_INTEGRITY_SECRET across upgrades and restores. Rotating or losing it prevents verification of the existing audit chain.
  • Complete one-time activation and MFA enrollment.
  • Configure exact-host HTTPS egress allowlists only where needed.
  • Centralize redacted security and audit logs.
  • Verify encrypted backups and a tested restore.

​
Before promotion

A general-availability release also requires a fresh Codex Security scan. Use pnpm security:compare <current-findings.json> to block new critical or high findings and reconcile every baseline fingerprint.

​
Air-gapped deployment

Import container images, signatures, checksums, and the SBOM through the organization’s approved transfer process. Mirror them in a trusted internal registry and preserve the original digest. Browser activation remains local and does not require outbound internet access.