This is a public chat endpoint. Anyone who can load the website can talk to it.

1. Regex classifier in app/services/moderation.py short-circuits jailbreak / abuse / noise before any LLM call.
2. The system prompt forbids instruction overrides, prompt extraction, and dumping the knowledge base.

Neither is airtight against a creative semantic attack. That is an accepted tradeoff at this scale.

• 20 requests / session / 10 minutes
• 40 requests / IP / 10 minutes (last X-Forwarded-For hop)
• Daily LLM budget in SQLite (default 300)

CORS is not authentication. Direct curl still works. Rate limits and the budget are what bound abuse.

• Body: 8KB
• Message: 2000 characters
• Graph timeout: CHAT_FLOW_TIMEOUT_SECONDS (default 25)
• Tool loop: LangGraph recursion_limit=12

• Environment variables only. .env is gitignored.
• Structured logs redact api_key, authorization, password, openai_api_key, anthropic_api_key, and zizkadb_api_key.
• LLM keys and the ZizkaDB API key never go to the browser or into ZizkaDB event payloads.
• ZizkaDB records user messages, replies, and tool I/O for this public portfolio agent (facts you wrote down). Do not put secrets in the knowledge base.

Clients only ever see {"error": "<message>"}. Stack traces stay in server logs with X-Request-ID.

Explicit origins only. Include both https://example.com and https://www.example.com if the host serves both without a redirect.