# RustyTorch++ Security Guidelines

## Overview

This document outlines security best practices for deploying and configuring RustyTorch++.

## Secret Management

### Environment Variables

Sensitive configuration should be provided via environment variables, NOT hardcoded in config files:

```bash
# Database credentials
export RTX_DATABASE__URL="postgres://user:password@host:5432/db"
export RTX_DATABASE__PASSWORD="<secure-password>"

# API keys
export RTX_HUB__API_KEY="<api-key>"
export RTX_AWS__SECRET_ACCESS_KEY="<aws-secret>"

# Authentication secrets
export RTX_AUTH__JWT_SECRET="<jwt-signing-key>"
export RTX_AUTH__SESSION_SECRET="<session-secret>"
```

### Configuration File Security

When using configuration files:

1. **Never commit secrets** - Use `.gitignore` to exclude:
   - `.env` files
   - `*.secret.toml` files
   - `credentials.json`

2. **Use placeholders** - Reference environment variables:
   ```toml
   [database]
   url = "${RTX_DATABASE__URL}"
   password = "${RTX_DATABASE__PASSWORD}"
   ```

3. **File permissions** - Restrict config file access:
   ```bash
   chmod 600 /etc/rustytorch/config.toml
   chown rtx-user:rtx-group /etc/rustytorch/config.toml
   ```

### Secret Rotation

1. **API Keys**: Rotate every 90 days minimum
2. **Database Passwords**: Rotate every 60 days
3. **JWT Secrets**: Rotate on security events or every 180 days
4. **Session Secrets**: Rotate on security events

## Input Validation

RustyTorch++ includes comprehensive input validation in `rtx-serving-api`:

```rust
use rtx_serving_api::{InputValidator, ValidationConfig};

// Use default limits
let validator = InputValidator::default();

// Validate tensor inputs
validator.validate_tensor_shape(&[32, 128, 768])?;
validator.validate_batch_size(64)?;
validator.validate_inference_input(&data, &shape)?;

// Sanitize user input
let model_id = InputValidator::sanitize_model_id(user_input)?;
```

### Default Limits

| Parameter | Default | Restrictive | Permissive |
|-----------|---------|-------------|------------|
| Max Request Size | 100MB | 10MB | 500MB |
| Max Tensor Dims | 8 | 6 | 16 |
| Max Tensor Elements | 100M | 10M | 1B |
| Max Batch Size | 256 | 64 | 1024 |
| Max Sequence Length | 128K | 32K | 1M |
| Max String Length | 1MB | 256KB | 10MB |

## Network Security

### TLS Configuration

Always use TLS in production:

```toml
[server]
tls_enabled = true
tls_cert_path = "/etc/ssl/certs/rtx.crt"
tls_key_path = "/etc/ssl/private/rtx.key"
min_tls_version = "1.2"
```

### Network Isolation

1. Run inference servers in isolated network segments
2. Use firewall rules to restrict access
3. Implement rate limiting (built-in):

```rust
use rtx_serving_api::RateLimitManager;

let rate_limiter = RateLimitManager::new(config);
```

## Dependency Security

### Automated Scanning

Security scanning is integrated into CI/CD:

```yaml
# .github/workflows/ci.yml
- name: Security audit
  uses: rustsec/audit-check@v2
```

### Current Vulnerabilities

See `SECURITY_AUDIT.md` for current vulnerability status and remediation plans.

### Dependency Updates

Run regular dependency updates:

```bash
# Check for updates
cargo outdated

# Run security audit
cargo audit

# Update dependencies
cargo update
```

## Runtime Security

### Circuit Breaker Pattern

Built-in resilience against cascading failures:

```rust
use rtx_serving_api::CircuitBreaker;

let breaker = CircuitBreaker::new(CircuitBreakerConfig {
    failure_threshold: 5,
    reset_timeout: Duration::from_secs(30),
    half_open_requests: 3,
});
```

### Resource Limits

Configure resource limits in production:

```toml
[limits]
max_concurrent_requests = 1000
max_memory_mb = 32768
request_timeout_ms = 30000
max_queue_size = 10000
```

## Audit Logging

Enable audit logging for security-sensitive operations:

```toml
[logging]
audit_enabled = true
audit_log_path = "/var/log/rustytorch/audit.log"
log_level = "info"

# Log these events
audit_events = [
    "model_load",
    "model_unload",
    "config_change",
    "auth_failure",
    "rate_limit_exceeded",
]
```

## Container Security

When deploying in containers:

1. **Use non-root user**:
   ```dockerfile
   USER rtx-user
   ```

2. **Read-only filesystem**:
   ```bash
   docker run --read-only ...
   ```

3. **No new privileges**:
   ```bash
   docker run --security-opt=no-new-privileges ...
   ```

4. **Resource limits**:
   ```bash
   docker run --memory=32g --cpus=8 ...
   ```

## Reporting Security Issues

Please report security vulnerabilities to: security@rustytorch.dev

Do NOT create public issues for security vulnerabilities.

## Security Checklist

Before deploying to production:

- [ ] No hardcoded secrets in code or config files
- [ ] All secrets provided via environment variables or secret manager
- [ ] TLS enabled for all network communication
- [ ] Rate limiting configured
- [ ] Input validation enabled (default)
- [ ] Circuit breaker patterns enabled
- [ ] Audit logging enabled
- [ ] Dependencies audited (cargo audit passes)
- [ ] Container running as non-root user
- [ ] Resource limits configured
- [ ] Network isolation in place