The dev module (seed data for serve --seed) is only needed during\ndevelopment. Added a default-on \"dev\" feature that gates the module\nand the --seed CLI flag. Release builds can opt out with\n--no-default-features.\n\nAssisted-by: GLM-5.1 via pi

diff --git a/Cargo.toml b/Cargo.toml
index c096ecc..f38a8eb 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -3,6 +3,10 @@ name = "quire"
 version = "0.1.0"
 edition = "2024"
 
+[features]
+default = ["dev"]
+dev = []
+
 [[bin]]
 name = "quire"
 path = "src/bin/quire/main.rs"
diff --git a/src/bin/quire/commands/mod.rs b/src/bin/quire/commands/mod.rs
index cde82ec..5219c76 100644
--- a/src/bin/quire/commands/mod.rs
+++ b/src/bin/quire/commands/mod.rs
@@ -1,4 +1,5 @@
 pub mod ci;
+#[cfg(feature = "dev")]
 pub mod dev;
 pub mod exec;
 pub mod hook;
diff --git a/src/bin/quire/main.rs b/src/bin/quire/main.rs
index 3aae139..3bf1c97 100644
--- a/src/bin/quire/main.rs
+++ b/src/bin/quire/main.rs
@@ -40,6 +40,7 @@ enum Commands {
     /// Start the HTTP server.
     Serve {
         /// Seed the database with dev data before starting.
+        #[cfg(feature = "dev")]
         #[arg(long)]
         seed: bool,
     },
@@ -207,13 +208,21 @@ async fn main() -> Result<()> {
     };
 
     match command {
-        Commands::Serve { seed } => {
+        Commands::Serve {
+            #[cfg(feature = "dev")]
+            seed,
+        } => {
+            #[cfg(feature = "dev")]
             let quire = if seed { commands::dev::seed()? } else { quire };
-            let ci_routes = quire::quire::web::router(quire.clone());
+            #[cfg(not(feature = "dev"))]
+            let ci_routes = quire::quire::web::router(quire.clone()).layer(
+                axum::middleware::from_fn(quire::quire::web::auth::require_auth),
+            );
+            #[cfg(feature = "dev")]
             let ci_routes = if seed {
-                ci_routes
+                quire::quire::web::router(quire.clone())
             } else {
-                ci_routes.layer(axum::middleware::from_fn(
+                quire::quire::web::router(quire.clone()).layer(axum::middleware::from_fn(
                     quire::quire::web::auth::require_auth,
                 ))
             };