• Change default JWT secret (use 64+ byte random value)
• Change default admin password
• Enable HTTPS only (disable HTTP in production)
• Configure proper CORS origins (not *)
• Implement API key authentication for event ingestion

• Use strong PostgreSQL password
• Enable SSL for database connections
• Restrict database access to backend service only
• Enable query logging for audit
• Set up automated backups

• Configure firewall (only 80/443 exposed)
• Use reverse proxy (Nginx/Traefik)
• Enable rate limiting
• Configure fail2ban for brute force protection
• Use private Docker network

• Use Docker secrets or external vault
• Rotate JWT secrets periodically
• Don't commit .env files
• Use different secrets per environment

• Enable audit logging
• Set up security alerts
• Monitor for unusual patterns
• Enable Prometheus metrics

# Generate JWT secret
openssl rand -base64 64

# Generate strong password
openssl rand -base64 32 | tr -d /=+ | cut -c1-25

1. Isolate affected services
2. Review logs: docker-compose logs > incident.log
3. Rotate compromised secrets
4. Restore from backup if needed

Report security issues to: security@your-domain.com