• CORS Configuration: Uses explicit origins from environment variables, not wildcards
• OAuth 2.0: Google OAuth for authentication
• Environment Variables: Sensitive data stored in .env.local (not committed to git)
• HTTPS Ready: FastAPI supports HTTPS in production
• Input Validation: Pydantic models validate all API inputs
• Token Tracking: Monitor and limit AI token usage per user
• Rate Limiting: Configurable limits on memories per day

The following are configured for local development:

• HTTP (not HTTPS) - acceptable for localhost
• CORS allows http://localhost:3002 and http://localhost:8000
• OAuth tokens stored unencrypted in SQLite database

Before deploying to production, implement these security measures:

# Use a reverse proxy like nginx or deploy to a platform that handles TLS
# Update CORS_ORIGINS in .env.local to use https://
CORS_ORIGINS=["https://yourdomain.com","https://api.yourdomain.com"]

# Generate a strong secret key
SECRET_KEY=$(python -c "import secrets; print(secrets.token_urlsafe(32))")

# Use production database
DATABASE_URL=postgresql+asyncpg://user:password@host:5432/memagent

# Update origins
FRONTEND_URL=https://yourdomain.com
CORS_ORIGINS=["https://yourdomain.com"]

• Use PostgreSQL instead of SQLite
• Enable SSL/TLS for database connections
• Encrypt OAuth tokens at rest (add encryption layer)
• Regular backups with encryption
• Rotate database credentials periodically

Already configured but can be adjusted:

# .env.local
MAX_MEMORIES_PER_DAY=10  # Adjust based on your needs

from fastapi.middleware.trustedhost import TrustedHostMiddleware

# Only allow requests from your domain
app.add_middleware(
    TrustedHostMiddleware,
    allowed_hosts=["yourdomain.com", "www.yourdomain.com"]
)

Add to nginx or use Starlette middleware:

X-Content-Type-Options: nosniff
X-Frame-Options: DENY
X-XSS-Protection: 1; mode=block
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: default-src 'self'

• Use HTTPS for OAuth redirect URIs
• Implement token encryption at rest
• Rotate refresh tokens periodically
• Add token revocation on logout
• Monitor for suspicious OAuth activity

Already implemented with Pydantic, but verify:

• Max length limits on all text inputs
• Sanitize file uploads
• Validate image files before processing
• Check for SQL injection attempts (SQLAlchemy handles this)

• Use structured logging (already implemented with structlog)
• Set up log aggregation (ELK, Datadog, etc.)
• Monitor for suspicious activity patterns
• Alert on unusual token usage
• Track failed authentication attempts

# Regularly update dependencies
uv pip list --outdated

# Audit for known vulnerabilities
pip install safety
safety check

# Use dependabot or similar for automated updates

In production, restrict API docs access:

# main.py
app = FastAPI(
    title="MemAgent API",
    version="0.1.0",
    docs_url="/docs" if settings.debug else None,  # Disable in production
    redoc_url="/redoc" if settings.debug else None,
)

Add to frontend response headers:

<meta http-equiv="Content-Security-Policy" 
      content="default-src 'self'; 
               script-src 'self' 'unsafe-inline' 'unsafe-eval'; 
               style-src 'self' 'unsafe-inline'; 
               img-src 'self' data: https:; 
               connect-src 'self' https://yourdomain.com;">

# frontend/.env.production
NEXT_PUBLIC_API_URL=https://api.yourdomain.com

If deploying to GCP (recommended for Google Photos integration):

• Enable HTTPS by default ✓
• Use Cloud SQL for PostgreSQL
• Use Secret Manager for sensitive data
• Enable Cloud Armor for DDoS protection
• Set up IAM roles correctly

1. Add production redirect URIs in Google Cloud Console
2. Restrict API keys to specific domains
3. Enable Google Photos Library API
4. Set up OAuth consent screen for production

1. Revoke all user tokens immediately
2. Force re-authentication for all users
3. Investigate access logs
4. Notify affected users
5. Rotate OAuth client secrets

1. Take database offline immediately
2. Rotate all credentials
3. Restore from clean backup
4. Audit for data exfiltration
5. Implement additional security measures

• Add privacy policy
• Implement data deletion on request
• Add consent management
• Data processing agreement with Google
• Regular security audits

• Define retention policies
• Implement automatic data cleanup
• Secure data deletion procedures

Before production deployment:

# Run security scan
bandit -r backend/

# Test for common vulnerabilities
pytest tests/security/

# Load testing
locust -f tests/load/locustfile.py

# Penetration testing (hire professional)
# OWASP ZAP or similar tools

The CORS configuration is already secure for development:

# Uses environment variable from .env.local
CORS_ORIGINS=["http://localhost:3002","http://localhost:8000"]

# In main.py:
allow_origins=settings.cors_origins  # NOT ["*"]
allow_credentials=True  # Required for OAuth
allow_methods=["GET", "POST", "PUT", "DELETE", "OPTIONS"]  # Explicit list

1. ✅ Explicit Origins: Only listed domains can make requests
2. ✅ No Wildcards: Never uses ["*"] with credentials
3. ✅ Configurable: Change origins via environment variable
4. ✅ Credentials Enabled: Required for OAuth cookies/sessions
5. ✅ Explicit Methods: Only allows specific HTTP methods
6. ✅ Preflight Caching: Reduces OPTIONS requests

Simply update .env.local:

CORS_ORIGINS=["https://yourdomain.com"]
FRONTEND_URL=https://yourdomain.com

For security concerns or questions, consult:

• OWASP Top 10
• FastAPI Security
• Next.js Security