ArxMedia is built first for self-hosting.

• Assume private or home-lab deployment by default.
• If you expose it to the public internet, harden your setup first.

• Set a strong SECRET_KEY. With DEBUG=False the app refuses to start if it is shorter than 50 characters or still a placeholder.
• Set DEBUG=False outside local development (compose.prod.yaml defaults to it). DATABASE_URL and FERNET_KEY are then required.
• Use strong database credentials. compose.prod.yaml requires SECRET_KEY and POSTGRES_PASSWORD to be set.
• Only set USE_X_FORWARDED_HOST=True when a trusted reverse proxy sets X-Forwarded-Host.
• Keep .env private and never commit it.
• Put the app behind a reverse proxy with HTTPS.

• Please do not post exploit details in a public issue.
• Open an issue with minimal details, then coordinate privately with the maintainer.
• Include repro steps and impact so it can be fixed quickly.

• Commit placeholders in .env.example, never real secrets.
• Rotate any key or token that is accidentally exposed.