# Pyrk Production Checklist

## Hosting and HTTPS

- Use a production Linux host or managed PHP hosting, not AMPPS.
- Install a valid TLS certificate.
- Redirect all HTTP traffic to HTTPS.
- Set `env => production`, `debug => false`, `force_https => true`, and `secure_cookies => true`.

## Accounts and access

- Delete or disable `public/login-dev.php`.
- Create named admin accounts; do not share one admin login.
- Use strong passwords and consider two-factor authentication in a later phase.
- Limit medical/emergency information to walk leaders and authorized staff only.

## API keys

- Restrict Google browser key by HTTP referrer.
- Restrict Google server key by IP and only the Routes API.
- Store Meta/WhatsApp tokens outside version control.
- Rotate keys if they are accidentally shared.

## Database

- Use a unique database user with only the permissions the app needs.
- Enable daily backups.
- Test restoring a backup.
- Review indexes after real traffic starts.

## File uploads

- Keep uploaded files outside public web root where possible.
- Reject executable extensions.
- Validate MIME type and image dimensions.
- Add malware scanning for production.
- Define retention rules for photos and waiver signatures.

## Notifications

- Use real SMTP with authenticated sending.
- Use SPF, DKIM, and DMARC for the sending domain.
- Verify WhatsApp message templates and opt-in requirements.
- Log every sent, failed, and skipped reminder.

## Legal and consent

- Have a lawyer review the waiver.
- Version every waiver template.
- Keep signature timestamp, IP address, user agent, and waiver version.
- Publish privacy policy and photo consent language.
