# Production Checklist

- `APP_ENV=production`
- Strong JWT and webhook secrets, at least 32 characters
- Non-local odds, payment and KYC providers
- Provider base URLs and API keys configured
- PostgreSQL backups and point-in-time restore tested
- Redis persistence and monitoring configured
- `npm run db:deploy` completed
- `npm run preflight` passes
- Sentry or equivalent error monitoring connected
- Admin bootstrap password rotated after first login
- KYC withdrawal block enabled operationally
- Country allow/block lists reviewed by counsel
- Legal pages customized for the active license and markets
- Responsible gambling limits and auto-exclusion tested
- PSP webhook HMAC secrets rotated and documented
- Audit log retention policy documented
- Settlement and reconciliation runbooks approved