Production safety

Security guide

This checklist describes the customer integration boundary. UrTheProduct protects upstream provider credentials and package controls; your application remains responsible for protecting its purchased key, authenticating its users, and using outputs lawfully.

Secret boundary

• Call the API from a server, job worker, or trusted automation platform.
• Never expose the key in HTML, React props, hydration data, client logs, mobile code, public build variables, URLs, analytics, or error trackers.
• Redact patterns beginning with utp_live_ and utp_test_ in application logging.
• Restrict production-secret access to the smallest operational group and rotate after personnel or infrastructure changes.

Input and output data

• Send only data your organization is authorized to process.
• Remove unnecessary personal, confidential, regulated, or third-party data before submission.
• Use private uploads; arbitrary remote input URLs are rejected to reduce SSRF and uncontrolled retrieval.
• Treat generated output as untrusted data. Escape it before HTML rendering, validate JSON before acting on it, and never execute returned code automatically.
• Generated file URLs expire; do not log or publicly share them.

Prompt injection and automation

Do not give generated text direct authority over payments, credentials, database writes, or privileged tool calls. Validate any proposed action against deterministic application rules and require human approval for consequential operations.

Incident checklist

1. Revoke the exposed key and stop affected workers.
2. Rotate the secret in every environment and redeploy.
3. Review quota usage and safe request IDs.
4. Remove leaked material from logs, tickets, and repositories where possible.
5. Contact support with the order reference and request IDs, not the compromised key.