NotYuSheng · NotYuSheng · Jul 28, 2026 · Jul 28, 2026
diff --git a/docs/index.rst b/docs/index.rst
@@ -61,8 +61,6 @@ Designed for air-gapped and offline deployments — GeoIP lookups use a bundled
    operations/backup-restore
    operations/logs-monitoring
    operations/production-hardening
-   operations/production-readiness
-   operations/security-audit
    operations/scalability
    operations/storage-redundancy
 

diff --git a/docs/operations/production-hardening.rst b/docs/operations/production-hardening.rst
@@ -4,6 +4,22 @@ Production Hardening
 The default TracePcap configuration is optimised for quick local testing.
 Before exposing the application to a wider audience, follow these steps.
 
+Checklist
+---------
+
+Any deployment beyond local development must:
+
+- Override **all** sample credentials — PostgreSQL, MinIO, and the Keycloak admin.
+- Restrict exposed services so PostgreSQL and MinIO are not externally reachable.
+- Terminate **TLS** at nginx.
+- Set explicit ``CORS_ALLOWED_ORIGINS`` if the frontend is served from a
+  different origin than the API.
+- Point the LLM at a **local inference server**, so capture-derived content is
+  never sent to a third party.
+- Enable authentication via the Keycloak overlay where the deployment is shared.
+
+Each is covered in detail below.
+
 Spring Profile per Deployment Mode
 ----------------------------------
 

diff --git a/docs/operations/production-readiness.rst b/docs/operations/production-readiness.rst
diff --git a/docs/operations/security-audit.rst b/docs/operations/security-audit.rst