# Lab security review

- [ ] Isolated VLAN/VM and non-production RouterOS device only
- [ ] Dashboard password set; HTTPS terminated by trusted proxy
- [ ] Port 3081 bound to loopback or lab subnet and firewall allowlisted
- [ ] API plaintext disabled; API-SSL certificate is trusted
- [ ] Custom RouterOS group reviewed; test is retained only as required, with no write, policy, sensitive or reboot rights
- [ ] Unique read-only credential; source address restricted
- [ ] Encryption key and app data protected and backed up
- [ ] Image tag pinned and release/dependency review recorded
- [ ] Session and audit behavior tested and documented
- [ ] Production use remains gated on security and operations approval