---
created_by: "Generated by AI gpt-5-codex on 2026-06-06T00:00:00Z. Human review required."
---

# QA Deployment Checklist

- Deploy to a private or isolated environment first.
- Point Apache DocumentRoot at `public/`.
- Confirm `app/`, `config/`, and `storage/` are not publicly reachable.
- Run first provisioning once, before any broader exposure.
- Verify the trusted auth config is created outside the web root.
- Confirm the setup flow refuses rerun after success.
- Validate login, browse, upload, download, rename, delete, and audit logging end to end.
- Only expand access after the private provisioning pass is complete and verified.