• Never commit production .env files
• Never commit database backups to public Git repositories
• Use strong database and pgAdmin passwords
• Restrict PostgreSQL access to internal systems
• Restrict pgAdmin access to administrators
• Terminate public traffic with HTTPS
• Apply Ubuntu and Docker security updates
• Back up securely and test recovery

For production, prefer:

ports:
  - "127.0.0.1:5432:5432"

or remove the PostgreSQL port mapping entirely when only containers need access.

The closed Holocaust corpus must not be published in GitHub. Use Lancaster GitLab, SFTP, encrypted institutional storage, or another approved secure transfer method.