evernote-prod-checklist

# Evernote Production Checklist ## Overview Comprehensive checklist for deploying Evernote integrations to production, covering API key activation, security hardening, rate limit handling, monitoring, and go-live verification. ## Prerequisites - Completed development and testing in sandbox - Production API key approved by Evernote (requires review process) - Production infrastructure provisioned ## Instructions ### API Key & Authentication - [ ] Production API key requested and approved by Evernote - [ ] `EVERNOTE_SANDBOX=false` in production config - [ ] Consumer key and secret stored in secrets manager (not env files) - [ ] OAuth callback URL uses HTTPS on production domain - [ ] Token expiration tracking implemented (`edam_expires`) - [ ] Token refresh/re-auth flow tested end-to-end ### Security - [ ] Access tokens encrypted at rest (AES-256-GCM) - [ ] CSRF protection on OAuth flow - [ ] API credentials not in source control (`.env` in `.gitignore`) - [ ] Log output redacts tokens and PII - [ ] Input validation on all user-supplied content (ENML sanitization) - [ ] Rate limit handling prevents API key suspension ### Rate Limits & Performance - [ ] Exponential backoff on `RATE_LIMIT_REACHED` errors - [ ] Minimum delay between API calls (100-200ms) - [ ] Response caching for `listNotebooks()` and `listTags()` (5-10 min TTL) - [ ] `findNotesMetadata()` used instead of `findNotes()` for listings - [ ] Batch operations use sequential processing with delays ### Monitoring...