Production gate
Run this checklist before each public release. AINEXO AI already ships security headers via .htaccess (HSTS, X-Frame-Options, nosniff, Referrer-Policy, CSP Report-Only).
Verify
- Security headers present on HTML responses
- Forms validate required fields client + server (bridge/CRM)
- Error pages (404/500) do not leak stack traces
- Rate limiting where Agency OS APIs are online
- Privacy and Cookies pages reachable
- No secrets in frontend JS or public repos
- Lead capture remains Real-Only (no fake auto-leads)
Related
FAQ
Is CSP enforced?
Currently Report-Only in many deploys to avoid breaking third-party analytics/ads. Tighten carefully after monitoring.