# Production Deployment Checklist

1. PHP 8.2+ and MySQL 8+.
2. Import `database/schema.sql`.
3. Configure DB credentials in `config/config.php`.
4. Set the web server document root to `public/`.
5. Ensure `storage/uploads/` is writable, but do not expose executable files there.
6. Run `public/install.php` once to create the first Admin.
7. Remove or disable `public/install.php` immediately after setup.
8. Configure HTTPS.
9. Change database credentials and session/cookie settings for production.
10. Add server-side MIME/extension validation and malware scanning for production attachments.
11. Configure automated database backups.
12. Restrict Admin/Manager permissions according to institutional policy.