Security practices

Source access

• Grant the GitHub App only the repositories Kuberns needs.
• Review GitLab OAuth scope before approval.
• Remove access when a repository is no longer deployed.
• Protect deployed branches with your provider's review controls.

Secrets

• Store runtime credentials in environment variables, not Git.
• Use separate values for each environment.
• Rotate credentials after exposure.
• Avoid printing secret values in build or service logs.
• Use unique generated values for template authentication and encryption keys.

Access management

• Give users the lowest role required.
• Review Owner, Co-Owner, and Partner access regularly.
• Remove users who no longer need service access.

Domains

• Verify DNS targets before deleting old records.
• Keep the allocated Elastic IP record current for root domains.
• Wait for SSL activation before sending production traffic.

Data protection

Plan application-level backups and restore tests for stateful services. Resource provisioning and container self-healing are not substitutes for recoverable data backups.