Data Security

Your Application
    ↓ [HTTPS/TLS 1.3]
Laozhang API Gateway
    ↓ [Internal Network Encryption]
AI Model Service Provider
    ↓ [Real-time Processing]
Response Return
    ↓ [HTTPS/TLS 1.3]
Your Application

# All requests must use HTTPS
curl https://api.laozhang.ai/v1/chat/completions \
  -H "Authorization: Bearer your_api_key" \
  -H "Content-Type: application/json"

# HTTP requests will be rejected
curl http://api.laozhang.ai/v1/chat/completions
# Returns: 403 Forbidden

# API Key authentication
headers = {
    "Authorization": "Bearer your_api_key",
    "Content-Type": "application/json"
}

# Each API Key has independent permissions
# Cannot access resources of other users

Real-time Monitoring
    ↓
Abnormal Behavior Detection
    ↓
Automated Alerts
    ↓
Security Team Response
    ↓
Incident Handling

# Collected data
{
    "request_id": "req_123456",
    "timestamp": "2024-01-15 14:30:25",
    "model": "gpt-4-turbo",
    "tokens": 150,
    "status": "success"
}

# Not collected data
# - Request content
# - Response content
# - User prompts
# - AI-generated text

# ❌ Bad practice: Hardcode API Key
api_key = "sk-rHcKJkgO4y3e5CTdDd1a..."

# ✅ Good practice: Use environment variables
import os
api_key = os.getenv("LAOZHANG_API_KEY")

# ✅ Good practice: Use configuration files
import json
with open('config.json') as f:
    config = json.load(f)
    api_key = config['api_key']

# Enable request timeout
import requests

response = requests.post(
    "https://api.laozhang.ai/v1/chat/completions",
    headers=headers,
    json=data,
    timeout=30  # Prevent requests from hanging indefinitely
)

# Validate response
if response.status_code != 200:
    # Handle error
    print(f"Request failed: {response.status_code}")
    print(response.text)

# ✅ Always use HTTPS
api_url = "https://api.laozhang.ai/v1/chat/completions"

# ❌ Never use HTTP
# api_url = "http://api.laozhang.ai/v1/chat/completions"

# Validate SSL certificate
response = requests.post(
    api_url,
    headers=headers,
    json=data,
    verify=True  # Verify SSL certificate
)

# ❌ Bad practice: Directly send sensitive information
prompt = f"User password is: {user_password}"

# ✅ Good practice: Filter sensitive information
def filter_sensitive_data(text):
    """Filter sensitive information"""
    # Remove credit card numbers
    text = re.sub(r'\d{4}[-\s]?\d{4}[-\s]?\d{4}[-\s]?\d{4}', '[CARD]', text)
    # Remove ID numbers
    text = re.sub(r'\d{17}[\dXx]', '[ID]', text)
    # Remove phone numbers
    text = re.sub(r'1[3-9]\d{9}', '[PHONE]', text)
    return text

prompt = filter_sensitive_data(user_input)

Detect Incident
    ↓
Immediate Containment
    ↓
Impact Assessment
    ↓
User Notification (if necessary)
    ↓
Detailed Investigation
    ↓
Implement Fix
    ↓
Post-incident Review