Skip to main content
feather security-check passes. Run it on the server against the live file: feather security-check --env-file .env
SECRET_KEY is a real random value, not the scaffolded placeholder.
Your migrations are in the repository. migrations/versions holds the first migration and every one since, and they apply from an empty database. The migrations check in feather security-check covers the first part.
FLASK_CONFIG=production, which compose sets. Confirm with docker compose exec web printenv FLASK_CONFIG
TRUSTED_HOSTS lists the hostnames you serve, so a spoofed Host header cannot forge absolute URLs in emails and redirects.
OAUTH_CALLBACK_URL uses https:// and the exact hostname, www included, and matches the redirect URI in the Google Cloud Console.
JOB_SERIALIZER=json, the default. pickle will unpickle arbitrary objects off Redis, so switch only if a job argument genuinely cannot be JSON-encoded.
.env on the server is chmod 600 and not in git.
feather env check reports no missing keys.
A database that is not SQLite, with deploy/backup.sh in cron and one restore actually tested.
An external uptime monitor pointed at https://<domain>/health
docker compose logs capped. The generated file sets max-size: 20m and max-file: 3. Docker’s default grows until the disk fills.
Server backups or snapshots enabled at the provider as well.