Security notes

Never commit .env, the data store, LICENSE_MASTER_KEY, bootstrap credentials or API tokens.
Back up the encrypted data store together with the master key in separate, access-controlled locations.
Losing the master key makes private signing keys and stored license tokens unrecoverable.
Do not change the master key in place. A controlled decrypt/re-encrypt migration is required.
Publish the service only behind TLS and set LICENSE_PUBLIC_URL to the external HTTPS URL.
Rotate user passwords and management API tokens independently of signing keys.
Signing-key rotation is intentionally not an overwrite operation. Introduce a versioned key-rotation workflow and retain previous public keys until all old licenses expire.
The bundled JSON store is single-node. Use a transactional shared store before horizontal scaling.