# Security notes
- Use HTTPS only.
- Keep config.php outside the document root where possible.
- Delete install-admin.php after creating the administrator.
- Do not store WhatsApp cookies, OTPs, or session secrets.
- Rotate/revoke API keys immediately if exposed.
- Restrict public API access and configure rate limiting at the hosting/WAF layer.
- Back up MySQL and test restore procedures.
- Honor customer consent, opt-outs, provider rules, and applicable messaging laws.