Production checklist

Configure these settings before serving production traffic.

• security.allowedHosts lists every host name the server answers for (Hosts and proxies).
• The proxy overwrites X-Forwarded-Proto, X-Forwarded-Host and X-Forwarded-For; serve({ trustProxy: true }) is on only behind it, and security.trustProxy has the right hops and trustedPeers (Hosts and proxies).
• security.headers.hsts is set once every subdomain works over https (Secure headers).
• security.csp is on, tried with reportOnly first, and every inline script you add carries event.nonce (CSP).
• CSRF is left on; trustedOrigins lists only origins you control; every route with csrf = false verifies a signature (CSRF).
• security.cookieSecrets and the session secrets are 32 characters or more, come from the environment, and rotate with the new secret first (Cookies).
• The session cookie is named __Host-..., sign-in calls regenerate(), sign-out calls destroy(), and a shared SessionStore replaces the memory store when there is more than one process (Sessions).
• Sign-in, password reset and expensive routes have their own rate limit, in a shared store when there is more than one process (Rate limiting).
• defineEnv describes every variable, secrets are not DUSK_PUBLIC_, and nothing secret is read from import.meta.env (Environment variables).
• The limits fit your largest legitimate request; small endpoints use readTextLimited (Limits).
• Redirects that come from input go through redirect(), and trustedOrigins is empty or minimal (Redirects).
• onError forwards to your logging with event.id, and production runs the dusk build output (dev is false) (Errors in production, Deploy).
• The health path is probed by the platform, and the container runs as a non-root user (Deploy).