# Security notes (Paython / newpythoon)

## Production checklist

1. Set in `.env`:
   - `DEBUG=False`
   - Strong random `SECRET_KEY`
   - `ALLOWED_HOSTS` and `CSRF_TRUSTED_ORIGINS` for your domain
   - `SITE_URL=https://your-domain`
   - **`DASHBOARD_ENFORCE_PERMISSIONS=true`** (staff only see allowed sections)
2. Serve `/media/` via nginx/Apache with **no script execution** and `X-Content-Type-Options: nosniff`.
3. Keep `DJANGO_ADMIN_ENABLED=false` on production unless you need `/django-admin/`.
4. Run `pip install -r requirements.txt` (includes **Pillow** for upload content checks).

## What the app already does

| Area | Mitigation |
|------|------------|
| Rich HTML (TinyMCE) | **Bleach** on public output (`sanitize_html`); not stored sanitized |
| File uploads | Extension + size limits; **Pillow verify** for images; paths under `uploads/` only |
| Hidden media paths | POST tampering ignored unless a new file is uploaded |
| JSON-LD | `<` / `>` escaped in script JSON |
| Redirects | Same-site paths only (or same host as `SITE_URL`) |
| Public `href` | `javascript:` / `data:` blocked via `safe_href` / context sanitizers |
| CSRF | Enabled on dashboard and contact forms |
| Contact form | Rate limit + honeypot |
| Login | Rate limit; post-login redirect limited to `/admin` |

## Staff trust model

Anyone with **staff** access can change site content, uploads, redirects, and SEO. With `DASHBOARD_ENFORCE_PERMISSIONS=true`, grant only needed permissions per user.

## Reporting issues

If you find a vulnerability, contact the site owner privately; do not post exploits publicly before a fix.