Security

Overview of security features and recommendations for production. Baseline stance: outbound-only (no inbound connection to monitored machines needed), field encryption for sensitive credentials, deny-by-default on permissions and script execution, non-root containers. Details on the overall architecture: Concepts → Architecture → Security architecture.

• Encryption — AES-256-GCM field encryption, key management

• Tokens & API keys — hashing, rotation, lifetime

• TLS / reverse proxy — Let's Encrypt, custom cert, reverse proxy in front

• Hardening checklist — what to enable before production