In control-panel.compose.yml around lines 5–12, the loki service is ephemeral
and has no restart policy or persistent storage; update the service to include a
restart policy (e.g., restart: unless-stopped or restart: always) and attach a
named volume for Loki data (mount a volume such as loki_data to the container
path used for chunks/indexes), then declare that named volume at the bottom of
the compose file under volumes:. Do the same for Grafana and any other services
referenced in lines 21–50 (add restart policy and a named volume like
grafana_data mounted to /var/lib/grafana), and optionally add healthcheck blocks
after verifying the images support the checks.

In control-panel.compose.yml around lines 6, 14 and 46, the service image
references use the :latest tag which is non-deterministic; update each image
line to a specific validated tag or immutable digest (e.g., image:
grafana/loki:<version> or image: grafana/loki@sha256:<digest>) and wire those
versions into a .env file (or compose variables) so deployments are
reproducible; replace :latest occurrences at the noted lines with the chosen
tags/digests and update documentation/.env with the validated versions.

In control-panel.compose.yml around line 8 (and also lines 47-48), the service
port mappings currently expose Loki/Grafana on all network interfaces
("3100:3100" etc.); change each public mapping to bind to localhost by prefixing
the host IP (for example 127.0.0.1:3100:3100 and similarly for the other ports
on lines 47-48) so the UIs/APIs are only accessible from the local machine.

In control-panel.compose.yml around lines 24 to 26, anonymous Grafana access is
enabled with GF_AUTH_ANONYMOUS_ENABLED=true and GF_AUTH_ANONYMOUS_ORG_ROLE=Admin
which grants admin rights to anyone hitting port 3000; change
GF_AUTH_ANONYMOUS_ENABLED=false or at minimum set
GF_AUTH_ANONYMOUS_ORG_ROLE=Viewer, add GF_SECURITY_ADMIN_USER and
GF_SECURITY_ADMIN_PASSWORD via environment variables provided at deploy-time
(use Docker secrets, an env file not committed to VCS, or a mounted provisioning
file) and ensure the Grafana service binds only to localhost (127.0.0.1) for
non-public deployments to harden access.

In infrastructure/web3-adapter/package.json around lines 21-22, the package
still depends on stray test and Jest packages while the project is wired to
Vitest; remove the dependency "test": "^3.3.0" from dependencies, remove "jest",
"ts-jest" and "@types/jest" from devDependencies, delete any top-level "jest": {
... } config block if present, add "vitest": "^0.34.1" (or the repo's chosen
Vitest version) to devDependencies, update the "test" script to run Vitest
(e.g., "vitest" or "vitest run") and then run npm/yarn/pnpm install to refresh
the lockfile and ensure CI/docs reference npm test → Vitest.

In infrastructure/web3-adapter/src/logging/logger.ts around line 4, the Pino
instance is created without an explicit log level or redact rules; initialize
pino with an options object that sets level from process.env.LOG_LEVEL (fallback
to "info") and a redact array of common sensitive keys (e.g.
"req.headers.authorization", "req.headers.cookie", "res.headers", "password",
"pass", "token", "secret", "apiKey", "loki.*") while keeping the existing
transport; also add a runtime check that when NODE_ENV !== "development" the
process ensures LOKI_USERNAME and LOKI_PASSWORD are provided via secure env vars
(throw or exit with a clear error if missing) rather than relying on defaults.

In infrastructure/web3-adapter/src/logging/transport.ts around lines 4 to 16,
pinoTransport is incorrectly used as a generic and credentials are insecurely
defaulted; replace the generic usage by creating a separate const lokiOptions:
LokiOptions = { host: process.env.LOKI_URL || "http://localhost:3100", labels: {
app: "web3-adapter" }, basicAuth: { username: process.env.LOKI_USERNAME,
password: process.env.LOKI_PASSWORD } } and pass lokiOptions to pinoTransport
(no generic), and add runtime checks that throw an error if LOKI_USERNAME or
LOKI_PASSWORD are missing in non-development environments (do not fall back to
"admin"/"admin"); ensure deployment provides
LOKI_URL/LOKI_USERNAME/LOKI_PASSWORD.

In platforms/pictique-api/src/database/data-source.ts around line 15, remove the
console.log that prints process.env.PICTIQUE_DATABASE_URL (it exposes sensitive
credentials); delete that line and, if you need a sanity check, replace it with
a non-sensitive indicator such as logging whether the variable is present (e.g.,
!!process.env.PICTIQUE_DATABASE_URL) or the masked DSN host using a small
sanitizer utility that parses the URL and returns only safe bits (host or a
masked string). Ensure no full DSN or credentials are ever logged.

In platforms/pictique-api/src/index.ts around line 19, the PORT value is
currently left as a string; coerce it to a number and ensure a safe fallback by
parsing the env var with a radix and defaulting to 1111 if parsing fails.
Replace the string assignment with a numeric parse (e.g.
parseInt(process.env.PORT ?? '1111', 10)) or equivalent and handle NaN by
falling back to 1111 so the app always gets a valid numeric port.

In platforms/registry/src/index.ts around line 27, the catch block currently
logs the error as detail which prevents Pino/Fastify serializers from preserving
stack/type; change the log call to pass the Error under the `err` key or pass
the error as the first argument (e.g. server.log.error({err: error, message:
"Error during database initialization"}) or server.log.error(error, "Error
during database initialization")) so serializers capture stack/metadata, and
update other catch blocks to the same pattern for consistency.