# Security Hardening — v0.34.0

Implemented/Prepared:
- DEBUG=False requires a real environment secret key; unsafe production fallback removed.
- Secure cookies, HTTPS redirect, HSTS, clickjacking and referrer policy are configurable from environment settings.
- Password minimum length is 10 characters.
- Database-backed failed-login lockout: default 5 failures / 15 minutes.
- Forced password-change workflow is enforced by middleware.
- Super Admin-only System Operations readiness screen exposes status but never secrets.
- Admin URL can be changed with DJANGO_ADMIN_PATH.
- Request/upload memory limits are configurable.

Local UAT gate:
- Generate migrations and test LoginAttempt table.
- Verify real HTTPS/proxy settings before increasing HSTS.
- Test role boundaries using separate real UAT accounts.
- Run `python manage.py check --deploy` on the actual deployment environment.