The starter includes JWT authentication, Argon2 password hashing, role-based API dependencies, CORS configuration, input validation, account activation controls, audit records and common response security headers.

Before production:

1. Replace all demonstration credentials and SECRET_KEY values.
2. Store secrets in a secret manager, not source control or Compose files.
3. Use HTTPS end to end and secure cookies or a hardened token-storage strategy.
4. Add refresh-token rotation and revocation for long-lived sessions.
5. Add login throttling, IP/device risk controls and optional MFA for administrators.
6. Verify payment webhooks cryptographically and make checkout idempotent.
7. Use signed media URLs; never expose private paid-course objects publicly.
8. Add backup, restore, retention and database encryption policies.
9. Add dependency scanning, SAST, DAST, container scanning and CI approval gates.
10. Add privacy, tax, refund, accessibility and content-moderation policies for the target region.