feat: build headless theatre laboratory website

docs/security.md

@@ -1,16 +1,23 @@
 # Security
 
-Describe security assumptions and controls.
+- Wagtail admin uses Django authentication, authorization, sessions, CSRF protection,
+  and password hashing. The public site does not add accounts or write endpoints.
+- The aggregate API is intentionally unauthenticated and returns published editorial
+  content only; secrets and unpublished drafts must never be serialized.
+- PostgreSQL has no host-published port. Web ports bind to loopback for local use.
+- Containers are unprivileged at the Compose level: no privileged mode, host network,
+  Docker socket, or added capabilities are used. `no-new-privileges` is enabled and
+  the application images run as non-root users.
+- `.env` is ignored. `.env.example` contains replaceable development placeholders,
+  never production credentials. Use a deployment secret manager outside local use.
+- `DJANGO_DEBUG` must be false and allowed hosts explicit outside development. Add TLS
+  at the edge before public exposure.
+- Database and uploaded media backups may contain personal data. Restrict, encrypt,
+  retain, and delete them according to the operator's privacy policy.
+- Avoid placing personal phone numbers or private contact details in logs. The API
+  legitimately exposes only contact details approved for publication.
+- Dependency and image versions are explicit. Operators remain responsible for patch
+  upgrades, vulnerability scans, and production digest pinning.
 
-Include:
-
-- authentication;
-- authorization;
-- network exposure;
-- TLS/certificates;
-- secrets management;
-- logging of sensitive data;
-- container privileges;
-- filesystem permissions;
-- dependency management;
-- relevant ADRs.
+Manual production hardening remains required for reverse proxy headers, TLS, media
+storage, backup retention, monitoring, and admin network policy.