🔒 Critical Security

Never share hmacSecret:

• Store it in environment variables (process.env.HMAC_SECRET)
• Don't put it in source code
• Don't share it via email or messages

Always use HTTPS:

• All requests must be over HTTPS
• Don't use HTTP in production

Key Rotation:

• Change hmacSecret periodically
• Use different keys for different environments (dev/staging/production)