This project implements multiple layers of security across both the backend (FastAPI) and frontend (Vanilla JS). Below is a full breakdown of every security measure implemented and why.

RATE_LIMIT_REQUESTS = 20    # max requests
RATE_LIMIT_WINDOW   = 60    # per 60 seconds

• Every /ask and /ingest request is checked against a per-IP sliding window
• Exceeding the limit returns HTTP 429 Too Many Requests
• Prevents abuse, API key exhaustion, and denial-of-service on the Groq endpoint
• Implementation: in-memory defaultdict — no Redis dependency for local demo

MAX_QUESTION_LENGTH = 1000   # characters
MIN_QUESTION_LENGTH = 3      # characters

• Questions shorter than 3 chars or longer than 1000 chars are rejected with HTTP 400
• Prevents prompt injection via oversized payloads
• Matches the maxlength="1000" attribute on the frontend textarea (belt-and-suspenders)

def sanitize_text(text: str) -> str:
    return re.sub(r'[\x00-\x08\x0B\x0C\x0E-\x1F\x7F]', '', text)

• Strips null bytes and dangerous control characters before the text reaches the LLM
• Preserves legitimate \n and \t characters
• Prevents null byte injection and control character exploits

Applied to every response via SecurityHeadersMiddleware:

allow_origins=["http://localhost:8000", "http://127.0.0.1:8000"]

• Changed from allow_origins=["*"] to localhost-only
• Prevents cross-origin requests from external domains
• Only same-origin frontend can call the API

TrustedHostMiddleware(allowed_hosts=["localhost", "127.0.0.1", ...])

• Rejects requests with unexpected Host headers
• Prevents host header injection attacks

SHUTDOWN_TOKEN = secrets.token_hex(16)

• /shutdown endpoint requires a cryptographically random token generated at startup
• Token is printed to server console — only someone with local server access can shut it down
• Uses secrets.compare_digest() to prevent timing attacks
• Prevents accidental or malicious remote server termination

<meta http-equiv="Content-Security-Policy"
      content="default-src 'self';
               script-src 'self';
               style-src 'self' https://fonts.googleapis.com;
               font-src 'self' https://fonts.gstatic.com;
               connect-src 'self' http://localhost:8000;
               img-src 'self' data:;
               frame-ancestors 'none';" />

• Blocks all inline scripts — prevents XSS via injected <script> tags
• Only allows connections to localhost:8000 — no data exfiltration
• Blocks the page from being embedded in iframes anywhere (frame-ancestors 'none')
• Allows only Google Fonts CDN for external resources

function escapeHtml(str) {
    return String(str)
        .replace(/&/g,  "&")
        .replace(/</g,  "&lt;")
        .replace(/>/g,  "&gt;")
        .replace(/"/g,  "&quot;")
        .replace(/'/g,  "&#x27;")
        .replace(/\//g, "&#x2F;");
}

• Applied to all user input before rendering in the DOM
• Applied to all API responses (AI answers, source titles, previews)
• Escapes 6 characters including ' and / which many implementations miss
• Prevents stored and reflected XSS from both user queries and LLM responses

const RATE_LIMIT  = 3;       // max queries
const RATE_WINDOW = 10000;   // per 10 seconds

• Client-side sliding window prevents rapid-fire requests before they hit the backend
• Shows a user-facing error message with countdown: "Wait Xs before next query"
• Complements (does not replace) backend rate limiting

• HTML: maxlength="1000" attribute on textarea
• JS: sanitizeInput() hard-slices at 1000 chars as fallback
• Visual: character counter turns amber at 700, red at 900
• Strips control characters client-side before sending to API

const controller = new AbortController();
const timeoutId  = setTimeout(() => controller.abort(), 30000);

• All API requests abort after 30 seconds
• Prevents the UI from hanging indefinitely on slow responses
• Shows user-friendly timeout message

<meta http-equiv="X-XSS-Protection"      content="1; mode=block" />
<meta http-equiv="X-Content-Type-Options" content="nosniff" />
<meta http-equiv="Referrer-Policy"        content="no-referrer" />
<meta name="robots"                       content="noindex, nofollow" />

• noindex, nofollow — prevents local demo from being indexed by search engines
• Redundant with backend headers for defense-in-depth

┌─────────────────────────────────────────────────────┐
│                    BROWSER                          │
│  CSP meta tag — blocks inline scripts & iframes    │
│  escapeHtml() — all DOM insertions sanitized        │
│  Frontend rate limit — 3 req / 10s                 │
│  Input maxlength + sanitization                     │
│  30s request timeout                                │
└──────────────────┬──────────────────────────────────┘
                   │ HTTPS / localhost
┌──────────────────▼──────────────────────────────────┐
│                 FASTAPI SERVER                      │
│  SecurityHeadersMiddleware — every response         │
│  TrustedHostMiddleware — host header validation     │
│  CORS — localhost only                              │
│  Rate limiting — 20 req / 60s per IP               │
│  Input validation — 3-1000 chars                   │
│  Input sanitization — control char stripping        │
│  Shutdown token — secrets.token_hex(16)             │
└──────────────────┬──────────────────────────────────┘
                   │
┌──────────────────▼──────────────────────────────────┐
│                 GROQ API                            │
│  API key stored in .env (never in code)             │
│  .env in .gitignore (never committed)               │
│  .env.example provided for setup guidance           │
└─────────────────────────────────────────────────────┘

• GROQ_API_KEY is loaded exclusively from .env via python-dotenv
• .env is listed in .gitignore — never committed to version control
• .env.example is provided showing required keys without values
• No API keys are hardcoded anywhere in the codebase

This is a local demo project built for i2e Hireathon 2026. It is not intended for public deployment.

If you find a security issue for educational purposes, feel free to open an issue or contact:

Somala Ajay — jaydeveloper010@gmail.com

Security implementation by Somala Ajay — i2e Hireathon 2026