Expose only the interfaces this node is meant to serve.

Secret-bearing files

• Never publish active database passwords, node private keys, producer keys, operator setup codes, webhook management tokens or webhook signing secrets.
• Build public archives from example configuration files, not the active config/config.php.
• Rotate credentials if they appear in logs, screenshots, source archives or support bundles.

Network exposure

• Keep standalone UI/RPC on localhost unless there is a deliberate reason to expose it.
• Expose P2P separately on the configured peer listener.
• Rate-limit write-heavy public P2P routes at a reverse proxy or firewall. Candidate block validation includes memory-hard participation verification.
• Keep private-peer acceptance disabled on public nodes unless your topology explicitly needs it.

Merchant features

Commerce payment verification does not require webhook management secrets. Leave Commerce webhooks disabled unless this node deliberately acts for a merchant backend.