# Safety Controls

## Production Boundary

The production site is `https://phyllisschlafly.com`.
Production is read-only unless the operator gives explicit approval for a specific change.
Local setup and validation must not change production.
Available credentials do not provide approval.

## Prohibited Repository Content

Never store these items in the repository:

- Secrets or credentials
- Private keys
- Database exports
- WordPress uploads
- WordPress core
- Dependencies
- Caches
- Logs

Keep local secrets in `.env`.
Keep `.env` outside version control.

## Network Safety

Keep TLS certificate and host verification active.
Do not bypass TLS verification.
Do not use insecure client flags.
Stop if the client cannot verify the remote system.

## Database Safety

Use a database account that has read-only grants.
Keep `WP_DB_SSL_MODE` set to `VERIFY_IDENTITY`.
Set `WP_DB_SSL_CA` to the approved CA certificate path.
Require certificate and hostname verification for each database connection.
Production SQL must start with `SELECT`, `SHOW`, `DESCRIBE`, or `EXPLAIN`.
Do not use transactions to test write statements.
Do not call stored procedures.
Do not run multi-statement queries.
Do not create database exports.

## Automation Safety

Do not put production credentials in GitHub Actions.
Do not add production write operations to automation.
Keep production deployment steps disabled until the operator approves a specific deployment.

## Change Check

Before each remote command:

1. Confirm the target host.
2. Confirm the production or local environment.
3. Confirm that the command is read-only.
4. Confirm that TLS or SSH host verification is active.
5. Stop if any result is uncertain.

Before each commit:

1. Run `git status --short`.
2. Run `git diff --cached`.
3. Review the complete staged diff.
4. Check for prohibited content.
5. Run `git diff --cached --check`.
6. Run `git diff --check`.