Guides · APRF practice notes
Security Guides
How-to depth for building controls: keep secrets out of clients, wire AuthN/AuthZ, stop injection, and throttle abuse. Maps to APRF Authentication, Authorization, Secrets, AI Security, and Tool Safety.
Implementation depth: AuthN, secrets, injection, and throttles — APRF Security domain.
For posture checklists, WAF, supply chain, and SOC 2 evidence patterns, see Cybersecurity guides.
AI Production Readiness Framework
Related APRF controls
- API Abuse Cost Example: What Happens Without Limits
A concrete abuse pattern: uncapped demo keys, silent scrapers, and a surprise cloud bill. Here is how to prevent the next one.
- API Gateway Rate Limiting in AWS
Add rate limiting to your API with AWS API Gateway. Throttling, usage plans, and per-key limits.
- What Happens If Your API Key Is Leaked?
A leaked API key can cost you thousands and expose your data. Here's what happens and what to do immediately.
- API Key Exposed in Frontend: What to Do Right Now
You just realized your API key is in client-side JavaScript. Here's how to contain the damage, rotate credentials, and fix the architecture so it never happens again.
- Why API Keys Should Not Be in Frontend
Putting API keys in JavaScript or mobile apps is one of the most common—and costly—security mistakes. Here's why and what to do instead.
- AWS Secrets Manager vs Parameter Store
Both store secrets. When to use Secrets Manager vs Parameter Store—rotation, cost, and use cases.
- Cloudflare Rate Limiting for APIs
Add rate limiting to your API with Cloudflare. No code changes—configure rules at the edge.
- How to Detect API Abuse Patterns
API abuse leaves patterns. High volume, unusual user agents, datacenter IPs. Here's how to detect them.
- IAM Least Privilege Example: AWS Simple
IAM least privilege means granting only the permissions each role needs. Here's a simple example and how to apply it.
- JWT vs API Key Authentication
JWT and API keys both authenticate requests. When to use each—stateless vs stateful, revocation, and use cases.
- Treat MCP Tool Results as Untrusted Context
Anything an MCP server returns—tool descriptions, Custom Rules, docs snippets, or call results—lands in the model context. Treat it as untrusted data. The host decides what tools may run.
- How to Prevent AI API Abuse
AI API keys are high-value targets. Here's how to keep them secure and prevent abuse before your bill explodes.
- How to Prevent API Abuse Without Authentication
Public APIs need protection even when you can't require user accounts. Rate limits, IP checks, and API keys can stop abuse.
- Prompt Injection and Jailbreaks in Production AI
Jailbreaks are not just demo tricks. In production they become data exfiltration, tool abuse, and policy bypass. Here's how to treat them as a security control, not a content filter afterthought.
- Public API Without Rate Limiting: The Risks
A public API with no rate limits is an open invitation for abuse. Here's what can go wrong and how to protect your endpoints.
- How to Rotate API Keys Safely
Rotating API keys without downtime. Create new, update config, deploy, then revoke old. Here's the process.
- How to Secure API Keys in JavaScript Frontend
API keys in frontend code are never secure. Here's how to architect your app so keys stay server-side and your frontend stays safe.
- How to Secure Your OpenAI API Key
OpenAI keys are high-value targets. Here's how to keep them secure—backend only, rate limits, and quotas.
- How to Stop API Scraping Attacks
Scrapers extract your data and abuse your API. Here's how to detect them and stop the attack before it costs you.
Next: Authentication
Open the related pillar specification for mandatory checks, artifacts, and pass conditions. Self-attest is optional.