Best Practices

Pin versions

Clone a specific tag or commit for production deployments rather than tracking a branch that can change under you:

git clone --branch v1.0.0 <repository-url>

Verify checksums

Where a release publishes a SHA256 checksum on the Downloads page, verify it before deploying:

sha256sum -c downloaded-file.sha256

Never commit secrets

Keep real credentials in .env (gitignored), never in .env.example or committed source files.

Run with least privilege

Don't run a project's process as root/Administrator unless its documentation explicitly requires it. Use a dedicated service account for anything long-running.

Back up before upgrading

For projects with a database, take a backup before pulling a new version and running migrations.