Secrets and configuration
API keys, database URLs, storage credentials, and payment secrets must be stored in environment variables, never in source code.
Security
Security
Storage and uploads
Production uploads should use signed URLs for Cloudflare R2 or AWS S3, with private buckets and scoped file keys.
Background processing
Manuscript analysis should run through Redis and Celery workers so long-running parsing, matching, and report generation do not happen in frontend requests.
Monitoring placeholders
Sentry, GA4, and Microsoft Clarity placeholders are included for production observability after consent and privacy checks.