# Production security checklist

Production security checklist for DRM-X 6.0 integrations: least-privilege credentials, server-side policy, secret handling, safe logs, transport boundaries, and release lifecycle.

Canonical: https://docs.drm-x.com/security/production-checklist
Updated: 2026-09-05

![Your backend decides access; DRM-X enforces the signed policy. Encrypted media and DRM licenses follow separate delivery paths.](https://docs.drm-x.com/assets/media-license-flow.svg)Your backend decides access; DRM-X enforces the signed policy. Encrypted media and DRM licenses follow separate delivery paths.

## Credential controls[#](#credential-controls)

- Create separate Development and Production API clients.
- Grant only `license-tokens:create` to playback integrations.
- Store the Access Key in a secret manager or protected runtime configuration, not source, images, frontend bundles, APKs, IPAs, or logs.
- Rotate immediately after suspected exposure and remove unused clients.
- Restrict outbound calls to the expected DRM-X API and proxy origins.



## Authorization controls[#](#authorization-controls)

- Resolve `subject` from the authenticated server session.
- Map catalog references to trusted Published protected file Content IDs on the server.
- Map product, plan, rental, course, device, or content tier to an approved named template or complete custom policy.
- Never accept manifest URL, license URL, policy JSON, quality entitlement, or customer identity from the player.
- Create a fresh unpredictable session ID for each real playback attempt.



## Transport and browser controls[#](#transport-and-browser-controls)

- Require HTTPS; validate TLS; reject untrusted redirects.
- Set explicit timeouts and request-size limits.
- Attach authorization only to the returned certificate, license, renewal, and release routes.
- Preserve native DRM challenge and license bytes exactly.
- Return playback responses with `Cache-Control: no-store` and avoid persistent browser storage.



## Evidence without secrets[#](#evidence-without-secrets)

Record correlation ID, stage, status, duration, environment, application ID, DRM, and a safe content reference. Redact headers and query strings. Do not record Access Keys, DRM License Tokens, content keys, private keys, certificates, native challenges, license bodies, or successful playback response documents.

**Accurate assurance language**Describe the current platform controls as ISO 27001-aligned or readiness work. Do not claim accredited ISO/IEC 27001 certification until certification is actually complete.



## Go-live acceptance[#](#go-live-acceptance)

- Prove denied entitlement, expired token, wrong DRM, wrong Content ID, and disallowed quality all fail closed.
- Test physical devices and output changes for every advertised platform.
- Confirm Stop, replacement, errors, and shutdown release concurrent reservations.
- Review redacted telemetry and incident runbooks.
- Back up protected configuration and prove restoration before launch.