Set credentials
Add a strong MACK_HQ_PASSWORD and random MACK_HQ_SESSION_SECRET to the host’s secret store.
Private deployment
Add a strong MACK_HQ_PASSWORD and random MACK_HQ_SESSION_SECRET to the host’s secret store.
Persist the app’s /data directory, or switch the provided store boundary to Supabase before serverless hosting.
Use HTTPS and preferably Cloudflare Access as a second gate. The app already sets secure production cookies and defensive headers.