Never commit .env, API keys, OAuth secrets, SMTP passwords, database credentials or private exports. Terminate TLS at the web tier, keep APP_DEBUG=false, rotate keys through controlled operations, and restrict writable paths to storage/ and bootstrap/cache/.

Web forms use sessions and CSRF. Admin routes require authentication plus the administrator middleware; protected API routes require bearer authentication and appropriate authorisation. Apply framework and dependency security updates after testing, and run composer audit and npm audit during each release.

Integration diagnostics mask secrets and log underlying failures server-side. Review log retention and access because errors may still contain operational metadata.

ARISE is Archaeological Routes for Inclusive Synergy & Entrepreneurship in Sierra y Mancha Conquense, developed by Obsidian Innovation Institute - Associação and Xilbi Sistemas de Informacion SL within the scope of the PoliRuralPlus project (Grant Agreement No 101136910).

The project PoliRuralPlus has received funding from the European Union’s Horizon Europe research and innovation programme under grant agreement No 101136910.

Views and opinions expressed are however those of the author(s) only and do not necessarily reflect those of the European Union or European Research Executive Agency (REA). Neither the European Union nor the granting authority can be held responsible for them.

First-party ARISE software and documentation are licensed under Apache-2.0. See LICENSE for the authoritative terms and NOTICE for project attribution. Third-party material retains its own terms.