This document covers how sensitive credentials are handled, what data flows through external services, and considerations for running this project in shared or production environments.

The project requires one external API key:

• NVIDIA_API_KEY: Used to access the NVIDIA NIM API for LLM inference. This key is sent as a Bearer token in the Authorization header of every LLM request.

This key is stored in the .env file at the project root. The .env file is listed in .gitignore and must never be committed to version control.

The Neo4j database is accessed with a username and password configured in .env:

• NEO4J_USER: Defaults to neo4j (the standard admin user).
• NEO4J_PASSWORD: The password set during Neo4j database creation.

These credentials are used to establish a Bolt protocol connection to the local Neo4j instance.

All credentials are read at application startup by backend/config.py using the python-dotenv library. They are stored in an immutable dataclass (Settings) and accessed as settings.NVIDIA_API_KEY, settings.NEO4J_PASSWORD, etc. Credentials are never logged, serialized to JSON, or exposed through API responses.

The following data is sent to the NVIDIA NIM API:

1. Document chunks during knowledge graph construction (triple extraction). Each chunk (up to 1500 characters) is sent to the LLM with a structured extraction prompt.

2. User queries and retrieved context during RAG and KAG pipeline execution. The query text and the retrieved chunks or graph triples are sent as part of the LLM prompt.

3. Answers and ground truth during LLM-as-Judge evaluation. Both the generated answer and the ground truth text are sent to the LLM for scoring.

No data is sent to any other external service. ChromaDB and Neo4j run locally.

• All source documents remain on disk in data/sample_docs/.
• The ChromaDB vector store is persisted locally in chroma_db/.
• The Neo4j knowledge graph is stored in Neo4j's local data directory.
• Evaluation results are saved to data/evaluation_results.json.

The backend server binds to 0.0.0.0:8000 when started with:

uvicorn backend.main:app --host 0.0.0.0 --port 8000

This makes the server accessible from other machines on the same network. If you are running on a shared network and do not want external access, bind to localhost instead:

uvicorn backend.main:app --host 127.0.0.1 --port 8000

The FastAPI application allows all origins (allow_origins=["*"]). This is appropriate for local development but should be restricted if the application is deployed to a shared server.

Neo4j listens on bolt://localhost:7687 by default. The Bolt protocol is not encrypted in the default Neo4j Desktop configuration. If running on a shared machine, consider enabling TLS in the Neo4j configuration.

The .env.example file contains all required variables with placeholder values. Copy it to .env and replace the placeholders with real credentials:

NVIDIA_API_KEY=nvapi-xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
NEO4J_URI=bolt://localhost:7687
NEO4J_USER=neo4j
NEO4J_PASSWORD=your-neo4j-password-here
CHROMA_PERSIST_DIR=./chroma_db
LLM_MODEL=meta/llama-3.1-8b-instruct
EMBEDDING_MODEL=sentence-transformers/all-MiniLM-L6-v2
CHUNK_SIZE=512
CHUNK_OVERLAP=50

1. Verify that .env is listed in .gitignore and is not tracked by git.
2. Run git status and confirm no files containing credentials are staged.
3. If deploying to a server, bind to 127.0.0.1 instead of 0.0.0.0.
4. Restrict the CORS policy to specific origins instead of "*".
5. Rotate API keys if they were accidentally committed at any point.
6. Review the Neo4j password strength. Avoid default or simple passwords.