Skip to main content
Use this checklist with the complete Hardening Guide.

​
Release gate

  • Deploy a signed, pinned release; never use latest.
  • Run ./casebender preflight.
  • Publish only Nginx ports 80 and 443.
  • Use trusted TLS and redirect HTTP to HTTPS.
  • Keep PostgreSQL, Redis, OpenSearch, API, ingestion, and processors on internal networks. Permit web and worker to reach only the approved external object-storage and malware-scanner endpoints.
  • Store .env, encryption keys, and license material in an approved secret store with least-privilege access.
  • Require the same AUDIT_INTEGRITY_SECRET on every web, api, and worker process that writes chained audit records.
  • Preserve AUDIT_INTEGRITY_SECRET with the database recovery set across upgrades and restores. Rotating or losing it prevents verification of the existing audit chain.
  • Complete one-time activation and MFA enrollment.
  • Configure exact-host HTTPS egress allowlists only where needed.
  • Centralize redacted security and audit logs.
  • Verify encrypted backups and a tested restore.
  • Apply the Storage Security Baseline; production bundles do not embed MinIO.

​
Before promotion

A general-availability release also requires a fresh Codex Security scan. Use pnpm security:compare <current-findings.json> to block new critical or high findings and reconcile every baseline fingerprint. The Runtime Security workflow must also pass on the release commit. It starts the production images and fails when:
  • a reachable Server Action is missing from scripts/security/server-action-allowlist.json, or authenticates after it reads data;
  • an anonymous caller receives data from any non-public Server Action;
  • the ZAP baseline or OpenAPI scan reports a failing alert.

​
Independent rescan

A finding is not closed by the engineer who fixed it. After remediation is merged, a different reviewer rescans the exact commit and records the result:
Each finding in scripts/security/codex-findings-map.json becomes verified-closed, or reopened when the rescan reports the same finding ID or fingerprint again. The command exits non-zero, and pnpm security:policy fails, while any finding is reopened. The scanner must differ from the remediation author.

​
Air-gapped deployment

Import container images, signatures, checksums, and the SBOM through the organization’s approved transfer process. Mirror them in a trusted internal registry and preserve the original digest. Browser activation remains local and does not require outbound internet access.