Security Hardening

Security best practices for production deployments.

AuthenticationCopy Anchor Link

Always set API_BEARER_TOKEN in production:

API_BEARER_TOKEN=$(openssl rand -base64 32)

Data and write API endpoints require the Authorization: Bearer *** header. Health endpoints such as /health, /health/live, and /health/ready remain unauthenticated so uptime checks can probe them.

Row Level SecurityCopy Anchor Link

Run the RLS script after schema setup:

-- scripts/security-rls.sql

-- Revoke public access
REVOKE ALL ON ALL TABLES IN SCHEMA public FROM anon, authenticated;

-- Enable RLS
ALTER TABLE documents ENABLE ROW LEVEL SECURITY;
ALTER TABLE chunks ENABLE ROW LEVEL SECURITY;

-- Deny all for public roles
CREATE POLICY "Deny anon" ON documents FOR ALL TO anon USING (false);
CREATE POLICY "Deny auth" ON documents FOR ALL TO authenticated USING (false);

Environment SecurityCopy Anchor Link

• Never commit .env to version control
• Use secret managers in production
• Rotate API keys regularly
• Use separate keys for dev/prod

Network SecurityCopy Anchor Link

• Deploy behind reverse proxy (nginx, Caddy)
• Enable HTTPS/TLS
• Set ALLOWED_ORIGINS for CORS
• Use private networking for database

Rate LimitingCopy Anchor Link

Built-in limits (not configurable):

LoggingCopy Anchor Link

• All logs go to stderr (stdout reserved for MCP)
• Set LOG_LEVEL=info in production
• Monitor for authentication failures
• Alert on repeated 401/403 errors

ChecklistCopy Anchor Link

• API_BEARER_TOKEN set (32+ chars)
• RLS script executed
• HTTPS enabled
• CORS configured
• Secrets in secret manager
• Logging configured
• Health monitoring active