# Pre-Launch Security Checklist

Use this checklist before deploying Turista to production or making it publicly available.

## Environment

- [ ] `APP_ENV=production`
- [ ] `APP_DEBUG=false`
- [ ] `APP_KEY` is strong and unique
- [ ] `.env` file is not readable by the web server (outside document root or denied by server config)

## Authentication & authorization

- [ ] `SANCTUM_TOKEN_EXPIRATION` is set to an appropriate value (default 1 week)
- [ ] `SANCTUM_STATEFUL_DOMAINS` is configured if using cookie-based SPA auth
- [ ] No default users seeded in production
- [ ] First super admin created via `php artisan admin:create-super`
- [ ] Super-admin password is provided securely (avoid `--password` on the command line)
- [ ] Login, OTP verify, and OTP resend endpoints return identical generic responses for missing/bad credentials

## API docs & debug exposure

- [ ] `REQUEST_DOCS_ENABLED=false`
- [ ] `NotFoundWhenProduction` middleware enabled in `config/request-docs.php`
- [ ] Telescope, Horizon, or other dev tools are not exposed

## CORS & headers

- [ ] `CORS_ALLOWED_ORIGINS` restricted to known frontend domains
- [ ] `config/cors.php` published and configured
- [ ] `SecurityHeadersMiddleware` active and sets CSP, HSTS, X-Frame-Options, etc.

## Dependencies

- [ ] `composer audit` reports no high/critical vulnerabilities
- [ ] `npm audit` reports no high/critical vulnerabilities
- [ ] Production dependencies installed with `composer install --no-dev`

## Database

- [ ] MySQL user has minimal required privileges
- [ ] Backups configured
- [ ] Migrations run successfully

## File uploads

- [ ] Upload size limits configured in web server and PHP
- [ ] MIME type validation active
- [ ] Image dimension limits configured
- [ ] Uploaded files are not executable
- [ ] Sensitive documents (reservation/on-arrival IDs) are stored on a private disk and served only through authorized/signed URLs

## Logging & monitoring

- [ ] Production logs are forwarded to a centralized system
- [ ] Audit logs (`audits` table) monitored
- [ ] Failed queue jobs reviewed
- [ ] Error tracking service integrated (recommended)

## Scheduler & queues

- [ ] Cron entry for `schedule:run` active
- [ ] Queue worker running under Supervisor/systemd
- [ ] `pending-reservations:release-expired` and `notifications:send-due` execute on schedule
- [ ] Scheduled commands use `->onOneServer()` when running multiple scheduler instances

## Communication

- [ ] `MAIL_MAILER` is set to a real provider in production (not `log`)
- [ ] CoreVerde WhatsApp credentials configured and tested
- [ ] OTP not returned in API responses

## Post-launch

- [ ] Health check endpoint returns `200 OK`
- [ ] Login endpoint returns tokens for valid credentials
- [ ] A sample reservation flow completes end-to-end
- [ ] Security headers verified with an external scanner