# SecureServe 0.1.1

SecureServe 0.1.1 is an early-access release for evaluation and controlled
deployments.

## Security and operations update

- Prevent initial administrator passwords from appearing in service logs
- Store first-run credentials in a mode `0600` file and remove it after change
- Verify encrypted Lightsail backups by decrypting and inspecting every archive
- Add a repeatable production port, service, host-key, and backup audit
- Further restrict the production systemd service's IPC and system calls

## Included

- SFTP server with password and SSH public-key authentication
- HTTPS administrator dashboard and user file portal
- Per-user private roots, permissions, quotas, and upload limits
- Expiring download shares and one-time external upload requests
- Audit logs and rotating local backups
- Standard and Pro plan enforcement
- Stripe Checkout subscription and signed Pro license activation

## Before internet exposure

- Install a trusted TLS certificate for the administrator and portal endpoints.
- Put the service behind a firewall or reverse proxy.
- Change the generated administrator password immediately.
- Back up the data directory and encryption/signing keys.
- Complete an independent security review and penetration test.
