# Pitfalls

- Do not leave `NEXTAUTH_SECRET` empty in production.
- Stripe webhooks require the raw body. Do not parse the webhook request before `stripe.webhooks.constructEvent`.
- `APP_ROOT_DOMAIN` must have wildcard DNS configured before customer subdomains work.
- Dokploy must be able to pull `HERMES_IMAGE` from the registry.
- The Traefik network name may differ in your Dokploy install. If so, update `HERMES_DOCKER_NETWORK`.
- Keep n8n out of this SaaS unless you have the right commercial license. This project is scoped to Hermes hosting.