Documentation · Security
Security hardening
Practical controls for teams self-hosting a template. This runs on your infrastructure — these are the same practices you'd apply to any production deployment.
Environment variables
- Never commit
.env.local— every template ships a.env.examplewith placeholders only. - Use separate keys and databases for dev, staging, and production.
- Rotate any secret that ever touched a client bundle, CI log, or shared terminal.
Stripe webhooks
- Verify the
Stripe-Signatureheader on every webhook — templates that include checkout ship this by default. - Reject stale timestamps to prevent replay.
- Keep your webhook signing secret out of the client bundle and version control.
Attestation & signing keys
- If you're using Flomisma Verify or a template with a ledger, the signing secret is symmetric (HMAC) — treat it like a database password, not a public key.
- Rotate it on a schedule and re-sign going forward; existing signatures made with the old secret remain independently verifiable if you keep it archived securely.
- An optional RFC 3161 timestamp anchor doesn't require a shared secret — see the Flomisma Verify README.
Rate limiting
- Templates that expose public API routes include a rate-limit primitive — configure limits for your own traffic patterns before going live.
- Put checkout and auth endpoints behind IP-based limits at minimum.