# Security
- Never commit `.env`.
- Rotate product API credentials after suspected exposure.
- Full license keys are not stored as reversible plaintext.
- Activation tokens are stored as SHA-256 hashes.
- Browser state changes require CSRF.
- Payment return pages must never provision licenses.
- Webhook processing must be idempotent and transaction-safe before live use.
- Do not expose `storage/`, `database/`, `config/`, or backups.