# Security notes

- Never commit `.env`, the data store, `LICENSE_MASTER_KEY`, bootstrap credentials or API tokens.
- Back up the encrypted data store together with the master key in separate, access-controlled locations.
- Losing the master key makes private signing keys and stored license tokens unrecoverable.
- Do not change the master key in place. A controlled decrypt/re-encrypt migration is required.
- Publish the service only behind TLS and set `LICENSE_PUBLIC_URL` to the external HTTPS URL.
- Rotate user passwords and management API tokens independently of signing keys.
- Signing-key rotation is intentionally not an overwrite operation. Introduce a versioned key-rotation workflow and retain previous public keys until all old licenses expire.
- The bundled JSON store is single-node. Use a transactional shared store before horizontal scaling.