Security Checklist

Use this checklist to ensure your deployment follows security best practices:

Development

• Use unique tokens for each developer
• Rotate tokens periodically
• Don't commit tokens to version control
• Use .env files (add to .gitignore)
• Run Jupyter on localhost only

Production

• Use HTTPS/TLS for all connections
• Generate strong random tokens (minimum 32 characters)
• Store tokens in secure secret management system
• Enable firewall rules to restrict access
• Use VPN or private networks when possible
• Implement token rotation policy
• Enable audit logging on Jupyter server
• Regular security updates for all components
• Monitor for unauthorized access attempts

JupyterHub

• Use API tokens with minimal scopes (access:servers only)
• Enable JUPYTERHUB_ALLOW_TOKEN_IN_URL in single-user environment
• Configure token expiration policies
• Implement single sign-on (SSO) if available
• Regular token audits and cleanup