Protect credentials, sessions, uploads, callbacks and staff access.

Production controls

• Use HTTPS, a private admin path, administrator 2FA and least-privilege roles.
• Leave API disabled until an explicit IP allowlist and scoped credential exist.
• Keep configuration, storage, logs and attachments non-executable.
• Patch PHP and dependencies; disable detailed production errors.

Extension rules

• Use verify_csrf() for browser mutations.
• Use prepared KB_DB calls, not concatenated SQL.
• Escape output with htmlspecialchars(..., ENT_QUOTES, 'UTF-8').
• Encrypt recoverable secrets; hash passwords one-way.
• Use TLS validation and bounded outbound timeouts.
• Never log secrets, authorization headers, raw callback payloads or card data.