Operational security checklistTLS on public hostsStrong passwords and rolesLeast-privilege API keysHMAC on webhooksSecurity banner clear of critical items