Security

Data and output

• Use prepared statements for database values. Do not pre-escape request input with addslashes().
• Native template values are escaped by default. Use raw HTML output only for trusted or safely rendered HTML.
• The Markdown renderer escapes raw HTML and allows only safe URL schemes. It does not execute PHP or template syntax.
• Keep Settings.json, passwords, and private keys out of version control.

Deployment

Use HTTPS, keep debug output disabled, change the demo password, and issue integration keys only with the scopes they need. Configure trusted proxies explicitly before using forwarded IP headers for rate limits. Back up the database before applying schema migrations; the Markdown migration preserves existing article bytes as legacy_html.

The CLI doctor command reports deployment checks. It is read-only and does not apply migrations.