# Secure upload checklist

1. Use PHP 8.2+ with PDO MySQL, fileinfo, and Zip extensions.
2. Create a database user limited to this application's database. Do not use `root`.
3. Set the five `SPARROW_*` environment variables shown in `.env.example` in the hosting control panel. Do not upload a populated `.env` file.
4. Import a separately transferred database backup through the hosting database tool. The upload package intentionally contains no SQL dumps, customer files, order references, approvals, or backup archives.
5. Point the domain to HTTPS before staff or customers sign in. Confirm HTTP redirects to HTTPS.
6. Ensure `storage/` is writable by PHP but cannot execute scripts. Apache protections are included; on Nginx/LiteSpeed, add an equivalent deny-execution rule.
7. Change all administrator and customer temporary passwords after migration.
8. Test login, contact, order upload, customer portal, and backup download on a staging hostname before switching DNS.
