# Security hardening — DBAOps Sovereign™ (production)

**Vendor:** RHOYLLE INNOVATION EMPIRE LLC  

Use with **`docs/CUSTOMER-DEPLOYMENT.md`**. This is **operational guidance**, not a certification.

---

## 1. Transport & edge

- Terminate **TLS** at a reverse proxy or load balancer in front of the API; do not expose Node on untrusted networks without TLS.  
- Restrict **CORS** (`CORS_ORIGIN`) to known dashboard origins only.

## 2. Secrets & auth

- **`JWT_SECRET`:** cryptographically strong, rotated per your policy; **never** commit to git.  
- **`SOVEREIGN_INGEST_KEY`:** strong random value; distribute only to collector hosts and automation.  
- **`SOVEREIGN_REQUIRE_AUTH`:** **true** in production for protected routes.  
- **`NODE_ENV=production`:** enables safe error responses and startup checks.

## 3. Database

- **`SovereignRepository`** access: least-privilege SQL login; **encrypt** connections when required (`SOVEREIGN_DB_ENCRYPT`).  
- Backups and DR: **customer responsibility** — document RPO/RTO in your runbook.

## 4. License & abuse

- **`SOVEREIGN_ENFORCE_LICENSE`:** keep **on** for paid production (mutations blocked when license invalid).  
- **Login:** rate limited; consider WAF / geo rules per your risk model.

## 5. Disclosure

- Define a **coordinated disclosure** or **security@** contact for your company; publish when you have a public security page.

---

© 2026 RHOYLLE INNOVATION EMPIRE LLC.
