If you discover a security vulnerability, please email security@company.com with:

• Description of the vulnerability
• Steps to reproduce
• Potential impact
• Suggested fix (if available)

Do not open public GitHub issues for security vulnerabilities.

1. Always enable authentication in production

   AUTH_REQUIRED=true

2. Use strong secrets (minimum 64 characters)

   node -e "console.log(require('crypto').randomBytes(64).toString('hex'))"

3. Rotate secrets regularly (every 90 days recommended)

4. Never commit secrets to version control

   • Add .env to .gitignore
   • Use environment variables or secret managers

1. Rate Limiting: Configured by default

   • Adjust limits based on your needs
   • Monitor for abuse patterns

2. Input Validation: All inputs validated with Zod

   • Never trust client input
   • Validate at API boundaries

3. HTTPS Only: Always use HTTPS in production

   • Obtain valid SSL/TLS certificates
   • Configure HSTS headers

4. CORS: Configure allowed origins

   CORS_ORIGIN=https://yourdomain.com

1. Sensitive Data

   • Never log API keys or secrets
   • Redact sensitive information in logs
   • Encrypt data at rest and in transit

2. Policy Documents

   • Validate file sizes (max 10MB default)
   • Sanitize input text
   • Consider data retention policies

3. Audit Logs

   • Enable comprehensive logging
   • Retain logs per compliance requirements
   • Secure log storage and access

1. Firewall Rules

   • Restrict access to necessary ports only
   • Use security groups/network policies
   • Implement IP whitelisting where appropriate

2. Updates & Patches

   • Keep Node.js updated
   • Regularly update dependencies
   • Monitor security advisories

3. Monitoring

   • Enable metrics collection
   • Set up alerting for anomalies
   • Review logs regularly

1. API Key Protection

   • Store in environment variables
   • Never expose in client-side code
   • Rotate keys if compromised

2. Rate Limiting

   • Respect OpenAI rate limits
   • Implement retry logic
   • Monitor usage and costs

3. Data Privacy

   • Review OpenAI's data usage policies
   • Consider data residency requirements
   • Implement data minimization

• No secrets in code
• Input validation on all endpoints
• Error messages don't leak sensitive info
• Dependencies regularly updated
• Security linting enabled

• HTTPS enabled
• Strong authentication configured
• Rate limiting active
• Security headers set (Helmet)
• CORS properly configured
• Firewall rules in place
• Monitoring and alerting configured

• Regular security audits
• Log review process
• Incident response plan
• Backup and recovery procedures
• Access control reviews

1. In-Memory Storage: Logs stored in memory

   • Consider persistent storage for production
   • Implement proper backup strategies

2. Token-Based Auth: Simple bearer token authentication

   • Consider OAuth2/OIDC for enterprise
   • Implement token refresh mechanisms

3. File Upload: Basic validation only

   • Add virus scanning for production
   • Implement content-type verification

• Database integration for persistent storage
• Advanced authentication (OAuth2, SAML)
• Encryption at rest
• Audit trail with immutable logs
• DDoS protection
• WAF integration

• Access controls implemented
• Audit logging enabled
• Encryption in transit (HTTPS)
• Monitoring and alerting
• Incident response procedures

• Data minimization principles
• Right to erasure (manual process)
• Data processing transparency
• Breach notification capability

• Access controls
• Audit controls
• Transmission security (HTTPS)
• Authentication mechanisms

• Added rate limiting
• Implemented security headers (Helmet)
• Enhanced error handling (no info leakage)
• Improved secret management
• Added retry logic for resilience

For security concerns:

• Email: security@company.com
• PGP Key: Available on request