# قائمة الأمان

- [x] admin routes protected by `auth`
- [x] CSRF on every state-changing form
- [x] validation and explicit mass assignment fields
- [x] passwords hashed and seeded from environment
- [x] uploads restricted to images and stored on public disk
- [x] remote URLs validated; article HTML sanitized or not rendered raw
- [x] Blade escaping retained for crawler text and unknown blocks
- [x] delete guarded for dependent categories
- [x] secrets excluded from repository
- [x] Standalone pre-bootstrap installer refuses access after `storage/app/installed.lock` exists.
- [x] Installer token is generated only by `tools/generate-installer-token.php`, compared with `hash_equals`, and ignored by git.
- [x] Installer writes `.env.pending` with restrictive permissions before atomic rename; secrets are not logged.
- [x] Production installation uses `migrate --force` only and does not run the development seeder.
- [x] Installer holds a process lock, checks Artisan exit codes, validates DB ownership, and verifies the super-admin role before completion.
- [x] Failed installation restores or removes `.env`; completed installation removes its one-time token and creates a non-public lock.
- [ ] After deployment, verify the document root is `public/` and remove any copied installer token/lock artifacts from the package.