Hardening Guide

Configure and test the host security boundaries

Use production authentication, explicit permission metadata, protected credentials, HTTPS, and appropriate network exposure. Restrict administrative and diagnostic endpoints. Review dependencies and the real application server headers and CORS settings.

Test denied access through every enabled API/process/export path and review custom code that accesses storage directly. The local sample and starter are learning tools; their mock/anonymous modes are not production defaults. QQQ features do not themselves certify a deployment.