TIYBAI

Security Center

How TIYBAI protects password records, account sessions, admin access, payment configuration, and production data.

Persistent production database

Production SQLite data should live outside app build and release folders at /data/tiybai/database.sqlite, with backups before every deployment migration.

Private areas stay private

Admin, auth, member, message, onboarding, and API routes are excluded from robots.txt and must remain protected by authentication and role checks.

Payment configuration

PayPal live and sandbox credentials must be saved and tested as a matched pair. Runtime configuration should come from one backend source of truth.

Deployment safety

Deprecated full-directory deploy scripts are disabled because they can overwrite runtime data. Production deploys should upload build artifacts and preserve the external data directory.