# Release security checklist

- [ ] Commit reviewed dependency lockfiles; run tests, Composer audit and image vulnerability scans.
- [ ] Upgrade plan before Laravel 12 security support ends (2027-02-24).
- [ ] Production debug off, unique protected APP_KEY, TLS + secure cookies verified.
- [ ] Correct trusted proxy allowlist; origin inaccessible except through intended proxy.
- [ ] Least-privilege runtime DB account; migration account separate; database/Redis private.
- [ ] Owner 2FA and recovery flow tested; revoked/inactive roles denied on existing sessions.
- [ ] CSP Livewire exceptions reviewed; no raw content HTML or executable admin code.
- [ ] All Livewire actions authorization-tested; no role escalation or cross-session results.
- [ ] Queue timeout/limits, worker memory, stale tasks and external cost quotas monitored.
- [ ] ClamAV fails closed and file workers isolated before exposing any file tools.
- [ ] SSRF, redirect, DNS rebinding, regex resource exhaustion tests before enabling relevant stubs.
- [ ] Analytics disclosure, consent, DNT/GPC and retention verified; no raw-IP or query-string logging at app/proxy/vendor layers.
- [ ] Operator legal/contact pages and original tool guides published and reviewed.
- [ ] Ads remain off until approved account and the included CMP/consent-gated loader/CSP are verified with real account IDs.
- [ ] Encrypted off-site backup and full restoration tested with APP_KEY recovery.
- [ ] MySQL/Redis/Horizon/Meilisearch integration, deployment smoke and independent security review passed.
- [ ] Mobile/browser accessibility, Lighthouse and real-load p95 latency measured.