# AGENTS.md: Hardening a prototype for production

Work through these in order. Each item is a separate small PR; report which items are done.

## 1. Secrets and config
- Move hard-coded keys/URLs into env vars, add `.env.example`, validate env at startup. Check git history for leaked secrets and tell the user which ones to rotate.

## 2. Auth and access control
- Every server route/action requires auth unless intentionally public. Add ownership checks on every record read or write. Database rules (RLS/policies) enabled where the platform supports them.

## 3. Input and data
- Schema validation on all inputs. Parameterized queries. Real migrations instead of manual schema edits; backups configured.

## 4. Errors and logging
- Global error handling with user-friendly messages; structured server logs; an error tracker (Sentry or similar) wired up but without PII.

## 5. Tests
- Smoke e2e test for the main user journey, unit tests for business logic, and CI running lint, typecheck, tests, and build on every PR.

## 6. Performance and limits
- Pagination on lists, rate limits on auth and expensive endpoints, image optimization, timeouts on external calls.

## 7. Operations
- Separate dev/staging/prod environments and databases. Health check endpoint. Documented deploy and rollback steps.

## 8. Legal and UX basics
- Privacy policy/terms placeholders flagged for the user, accessible forms, loading and empty states.

Don't deploy or change production settings yourself; prepare the changes and list what the user must do.