If you discover a security vulnerability in LUISA, please report it by emailing:

• Security Contact: [Your Security Email]

Do not create a public GitHub issue for security vulnerabilities.

We will respond within 48 hours and provide a timeline for fixes.

• OpenAI API keys (sk-proj-...)
• WhatsApp access tokens
• Service account JSON files
• Private keys (.pem, .key)
• .env files

• Use .env for all secrets (already in .gitignore)
• Rotate API keys if accidentally committed
• Use environment-specific secrets (dev/staging/prod)
• Audit git history: git log --all -p | grep -i "sk-"

• Customer phone numbers (hashed in traces)
• Conversation history
• Personal information in messages

• Phone numbers are hashed with SHA-256 in interaction_traces
• No credit card or payment info is stored
• Conversations can be deleted on request

• Implement data retention policy (delete old conversations)
• Provide data export API for customer requests
• Add consent tracking if required by jurisdiction

# Restrict file permissions
chmod 600 backend/luisa.db

# Encrypt backups
gpg --encrypt luisa-backup.db

# Regular backups (automated)
sqlite3 luisa.db ".backup 'backup.db'"

• Recommended for multi-instance deployments
• Enables row-level security
• Better concurrent access control

• No authentication on /api/chat (demo mode)
• CORS enabled for local development

# Add to main.py
from slowapi import Limiter
from slowapi.util import get_remote_address

limiter = Limiter(key_func=get_remote_address)

@app.post("/api/chat")
@limiter.limit("10/minute")  # Rate limiting
async def chat(request: Request, payload: ChatPayload):
    # Add API key check
    api_key = request.headers.get("X-API-Key")
    if api_key != os.getenv("INTERNAL_API_KEY"):
        raise HTTPException(403, "Forbidden")
    ...

• Verify webhook signature from Meta
• Use secure WHATSAPP_VERIFY_TOKEN
• Whitelist WhatsApp IP ranges

# Verify Meta signature
import hmac
import hashlib

def verify_webhook_signature(payload, signature):
    expected = hmac.new(
        WHATSAPP_APP_SECRET.encode(),
        payload.encode(),
        hashlib.sha256
    ).hexdigest()
    return hmac.compare_digest(expected, signature)

• Input sanitization (max 1200 chars)
• Business topic whitelist
• Cost controls (max tokens, timeouts)
• Forbidden word filtering

• Monitor usage: https://platform.openai.com/usage
• Set spending limits in OpenAI dashboard
• Review logs for prompt injection attempts

# Check for vulnerabilities
pip install safety
safety check

# Update dependencies
pip-review --auto

# Lock versions
pip freeze > requirements.txt

• Python 3.10+
• FastAPI 0.104+
• httpx 0.25+

• Use HTTPS only (no HTTP)
• Reverse proxy (Nginx, Caddy) with TLS 1.3
• Firewall rules (only expose 443, 8000 internally)

# Nginx example
server {
    listen 443 ssl http2;
    server_name luisa.elsastre.com;
    
    ssl_certificate /etc/letsencrypt/live/luisa.elsastre.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/luisa.elsastre.com/privkey.pem;
    
    location / {
        proxy_pass http://localhost:8000;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    }
}

• ✅ Uses parameterized queries (safe)

# Safe
cursor.execute("SELECT * FROM messages WHERE id = ?", (message_id,))

• ✅ Input length limits
• ✅ Business topic whitelist
• ✅ Forbidden phrases filter

• API requests (sanitized)
• OpenAI usage (tokens, cost)
• Handoff triggers
• Error traces

• API keys
• Customer passwords (if implementing auth)
• Raw customer personal data

# /etc/logrotate.d/luisa
/var/log/luisa/*.log {
    daily
    rotate 14
    compress
    delaycompress
    notifempty
    create 0640 www-data www-data
}

• All secrets in .env (not hardcoded)
• .env in .gitignore
• Git history audited for leaked keys
• API keys rotated (if previously exposed)
• Rate limiting enabled
• HTTPS enabled
• Webhook signature verification
• Database file permissions (600)
• Dependency vulnerability scan
• Error messages don't leak info
• Logs sanitized (no secrets)
• Backup encryption enabled
• Customer data retention policy defined
• Incident response plan documented

1. Immediately revoke the key in OpenAI/WhatsApp dashboard
2. Generate new key
3. Update .env in production
4. Restart services
5. Review usage logs for unauthorized access
6. Notify stakeholders if abuse detected

1. Take services offline
2. Restore from encrypted backup
3. Rotate all API keys
4. Audit access logs
5. Notify affected customers (if required by law)

• Implement data export API
• Add "Right to be Forgotten" (delete conversations)
• Log consent for data processing
• Provide privacy policy

• Do not store credit card numbers
• Use payment gateway (Stripe, PayPal)
• Only store transaction IDs

Security Issues: [Your Security Email]
General Support: [Your Support Email]

Last Updated: 2025-12-27