What do you verify before trusting a self-hosted CMS in production?

We’re launching YunCMS on September 14. It’s an open-source, self-hosted MySQL CMS/backend that grew out of watching teams rebuild authentication, permissions, CRUD, file handling and extension plumbing across projects. Now AI tools also need to work with those systems without bypassing permissions.

Before you trust a new self-hosted backend, what do you test first?

My current shortlist:
• a backup and restore flow you have actually tested
• field- and row-level permissions, including the Public role
• session and API-token behavior behind a reverse proxy
• file-storage recovery
• a predictable, pinned update path
• AI and MCP access constrained by the same RBAC as human users

YunCMS is still in the 0.1.x pre-stable line, so this is exactly the kind of feedback we want before claiming maturity.

What would you add to the list, and which item has caused the most pain in a real deployment?