I don't know about your set up but normally what I've seen done is:
There is one folder for production and one for Development, and they both have exactly the same structure, eg depending on how your company works there are subdirectories for Apps, data sources, QVDs, generators, customers etc.
When writing the document, even outside the QDF (is this what you mean) the apps use relative paths which mean that they can be copied and pasted between the two directories without any amendment needing to take place.
Apps will also reference an "include" file somewhere in the directories.This include file will contain data connection strings which may be different if you have dev environments for your data sources as well as Qlik.
There's a folder for meta-data ("config") within the framework.
Security rules if you are using section access will be dependant on each app, the list of users etc will depend on how you connect to that.
The QDF is great as there is a load of documentation on it on the web and has custom desktop apps that simplify and help administrate it.. This blog gives a great overview here: