This document outlines the security features, best practices, and deployment guidelines for the Contract Analysis System. The system has been hardened against common vulnerabilities and follows industry best practices for secure application deployment.

• API Key Authentication: All API endpoints (except /health) require Bearer token authentication
• Environment-based Configuration: API keys stored in environment variables
• Development Mode Warning: System warns when running without authentication

Setup: Generate secure API key: python -c "import secrets; print(secrets.token_urlsafe(32))" Add to .env: API_SECRET_KEY=your_generated_key_here

Usage: curl -H "Authorization: Bearer YOUR_API_KEY" http://localhost:8000/api/settings

• /health: 30 requests/minute
• /api/contracts/upload: 10 requests/minute
• /api/analysis/start: 5 requests/minute
• /api/settings (POST): 5 requests/minute
• Other endpoints: 10 requests/minute

• Path traversal prevention (filename sanitization)
• File size limits (10MB maximum)
• Streaming upload with chunked processing
• Extension validation (.pdf, .doc, .docx, .txt)
• Unique filename prefixes to prevent overwrites

• Pydantic models for settings validation
• Collection name validation (alphanumeric only)
• Query length limits (max 5000 characters)

• Sanitized error messages (no sensitive data exposure)
• Separate audit logging
• Generic client errors (no stack traces)

• Restricted to specific origins
• Limited HTTP methods (GET, POST only)
• Limited headers (Content-Type, Authorization)

• Connection limit (100 max)
• Timeouts (1 hour max, 5 min idle)
• Automatic cleanup

• SHA-256 for file hashing (replaced MD5)
• Secure random task IDs

• Global state protection with locks
• Atomic settings updates

• Resource limits
• Security options (no-new-privileges)
• Network isolation

1. Set strong API_SECRET_KEY (32+ characters)
2. Update FRONTEND_URL to production domain
3. Configure HTTPS/TLS termination
4. Set up firewall rules
5. Configure monitoring and alerting
6. Review backup procedures
7. Test all security controls

1. Authentication: curl http://localhost:8000/api/settings (should return 401)
2. Path traversal: Upload file with ../../../ in name (should reject)
3. File size: Upload 15MB file (should reject with 413)
4. Rate limiting: Send 30 rapid requests (should throttle)

• OWASP ZAP for web app scanning
• Bandit for Python security linting
• Safety for dependency vulnerabilities

1. Detect: Monitor logs and alerts
2. Contain: Isolate systems, revoke keys
3. Investigate: Analyze attack vector
4. Eradicate: Patch vulnerabilities
5. Recover: Restore from backups
6. Document: Write incident report

• Security issues: Report via GitHub Issues (mark as security)
• Critical vulnerabilities: Contact maintainers directly

Last Updated: January 2025