fix: harden sessions and domain validation

2026-09-01 18:58:18 +02:00
parent 480494c5ed
commit 9f5142b071
9 changed files with 40 additions and 16 deletions
@@ -33,4 +33,4 @@ find app config database public -type f -name '*.php' -print0 | xargs -0 -n1 php
 - Do not commit `.env` or production credentials.
 - Set `APP_KEY` to a long random value and keep it in a secrets manager in production.
 - Credential vault encryption and the remaining domain modules are scheduled in later phases.
- The initial schema is intentionally migration-ready but is delivered as an idempotent bootstrap SQL file for the first Docker increment.
+- The initial schema is delivered as a Docker bootstrap SQL file. Apply it once to a new database; later releases should use versioned migrations.