> ## Documentation Index
> Fetch the complete documentation index at: https://docs.casebender.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Deployment Security

> Required security controls for production and air-gapped CaseBender deployments

Use this checklist with the complete
[Hardening Guide](/en/security/hardening-guide).

## Release gate

* Deploy a signed, pinned release; never use `latest`.
* Run `./casebender preflight`.
* Publish only Nginx ports 80 and 443.
* Use trusted TLS and redirect HTTP to HTTPS.
* Keep PostgreSQL, Redis, OpenSearch, MinIO, API, ingestion, and processors on
  internal networks.
* Store `.env`, encryption keys, and license material in an approved secret
  store with least-privilege access.
* Preserve `AUDIT_INTEGRITY_SECRET` across upgrades and restores. Rotating or
  losing it prevents verification of the existing audit chain.
* Complete one-time activation and MFA enrollment.
* Configure exact-host HTTPS egress allowlists only where needed.
* Centralize redacted security and audit logs.
* Verify encrypted backups and a tested restore.

## Before promotion

```bash theme={null}
pnpm security:policy
pnpm security:test
node scripts/deployment/preflight.mjs --configuration-only
node scripts/deployment/canary-check.mjs \
  https://casebender.your-company.example
```

A general-availability release also requires a fresh Codex Security scan. Use
`pnpm security:compare <current-findings.json>` to block new critical or high
findings and reconcile every baseline fingerprint.

## Air-gapped deployment

Import container images, signatures, checksums, and the SBOM through the
organization's approved transfer process. Mirror them in a trusted internal
registry and preserve the original digest. Browser activation remains local and
does not require outbound internet access.