# Production Hardening Checklist

## Environment

- Keep `.env` out of git and deployments artifacts.
- Required production values:

```env
APP_ENV=production
APP_DEBUG=false
LOG_LEVEL=error
QUEUE_CONNECTION=database
```

## Scheduler / Cron

Laravel scheduler must run every minute:

```bash
* * * * * php /path/to/project/artisan schedule:run >> /dev/null 2>&1
```

Configured jobs include:
- `binary:match` every 5 minutes
- rank engine daily
- wallet reconciliation daily
- failed payout/webhook retries every 5 minutes

## OTP Security

- Disable OTP response exposure in production:

```env
OTP_EXPOSE_IN_RESPONSE=false
```

- Configure OTP defaults:

```env
OTP_TTL_MINUTES=5
OTP_LENGTH=6
OTP_MAX_ATTEMPTS=5
```

- Login OTP is configurable in Admin Settings:
  - `login_otp_enabled`
  - `login_otp_force_all`

## Notification Channels

Set channel endpoints/tokens in Admin Settings or env:

```env
WHATSAPP_API_URL=
WHATSAPP_API_TOKEN=
WHATSAPP_SENDER_ID=
SMS_API_URL=
SMS_API_TOKEN=
SMS_SENDER_ID=
```

SMTP can be configured in Admin Settings and tested from:
- `Admin -> Settings -> SMTP Test`
- `Admin -> Settings -> WhatsApp Test`

## Verification

Run tests before release:

```bash
php artisan test
```

