Security Best Practices

Protect your Fincept account, API keys, and financial data with these security guidelines.

API Key Security

Never Expose Keys Publicly

Don't Commit to Version Control

Bad:

# config.py
API_KEY = "fk_user_Hy8kL2mN9pQ1..." #  NEVER DO THIS

Good:

# config.py
import os
API_KEY = os.getenv("FINCEPT_API_KEY") #  Use environment variables

Add to .gitignore:

.env
.env.local
config.json
secrets.*
*.key

Don't Hardcode in Frontend

Bad:

// app.js - Client-side code
const API_KEY = "fk_user_Hy8kL2mN9pQ1..."; //  Exposed to users!

Good:

// backend/server.js - Server-side only
const API_KEY = process.env.FINCEPT_API_KEY; //  Secure

Never expose API keys in client-side JavaScript, mobile apps, or browser code!

Don't Share in Public Forums

When sharing code snippets in GitHub issues, Stack Overflow, or Discord:Bad:

curl -H "X-API-Key: fk_user_abc123..." #  Real key visible

Good:

curl -H "X-API-Key: YOUR_API_KEY_HERE" #  Placeholder

Don't Log Keys

Bad:

logger.info(f"Using API key: {API_KEY}") #  Logged

Good:

logger.info(f"Using API key: {API_KEY[:10]}***") #  Redacted

Store Securely

Environment Variables
Secret Managers
Config Files

Linux/macOS (.bashrc or .zshrc):

export FINCEPT_API_KEY="fk_user_your_key"

Windows (System Environment):

setx FINCEPT_API_KEY "fk_user_your_key"

.env file (with python-dotenv):

FINCEPT_API_KEY=fk_user_your_key

from dotenv import load_dotenv
load_dotenv()

API_KEY = os.getenv("FINCEPT_API_KEY")

AWS Secrets Manager:

import boto3

client = boto3.client('secretsmanager')
secret = client.get_secret_value(SecretId='fincept/api-key')
API_KEY = secret['SecretString']

HashiCorp Vault:

import hvac

client = hvac.Client(url='https://vault.company.com')
secret = client.secrets.kv.v2.read_secret_version(path='fincept/api-key')
API_KEY = secret['data']['data']['key']

Azure Key Vault:

from azure.keyvault.secrets import SecretClient

client = SecretClient(vault_url="https://myvault.vault.azure.net", credential=credential)
API_KEY = client.get_secret("fincept-api-key").value

config.json (not committed):

{
  "fincept_api_key": "fk_user_your_key"
}

Add to .gitignore:

config.json
config.*.json
secrets.json

Load in code:

import json

with open('config.json') as f:
    config = json.load(f)
API_KEY = config['fincept_api_key']

Password Security

Strong Password Requirements

Password Don’ts

Don’t use dictionary words
Don’t use personal information
Don’t reuse passwords from other sites
Don’t share with team members
Don’t write down on paper
Don’t email passwords

Password Manager

Use password managers to generate and store strong passwords:

1Password - Enterprise-ready
Bitwarden - Open-source
LastPass - Popular choice
Dashlane - User-friendly

Account Security

Enable MFA

Always enable on production accounts:

curl -X POST https://finceptbackend.share.zrok.io/user/mfa/enable \
  -H "X-API-Key: fk_user_your_key"

Learn more about MFA → Check regularly for suspicious logins:

curl https://finceptbackend.share.zrok.io/user/login-history \
  -H "X-API-Key: fk_user_your_key"

Look for:

🚨 Unfamiliar IP addresses
🚨 Unusual login times
🚨 Failed login attempts
🚨 Multiple failed MFA attempts

Rotate API Keys

Regenerate keys periodically:

Account Type	Recommended Rotation
Development	Every 180 days
Production	Every 90 days
Enterprise	Every 30-60 days
Compromised	Immediately!

Network Security

HTTPS Only

Always use HTTPS, never HTTP: https://finceptbackend.share.zrok.io http://finceptbackend.share.zrok.io

Firewall Rules

Restrict outbound API calls to Fincept domain:

# Allow only Fincept API
iptables -A OUTPUT -d finceptbackend.share.zrok.io -j ACCEPT

VPN/Private Networks

For sensitive operations:

Use VPN for remote access
Restrict API access to corporate networks
Implement IP whitelisting (enterprise feature)

Application Security

Validate Input

Never pass user input directly to API: Bad:

# User can inject malicious values
user_input = request.get("strike")
api_call(strike=user_input) #  Dangerous

Good:

# Validate and sanitize
try:
    strike = float(request.get("strike"))
    if strike <= 0 or strike > 1000000:
        raise ValueError("Invalid strike")
    api_call(strike=strike) #  Safe
except ValueError:
    return {"error": "Invalid input"}

Rate Limiting

Implement client-side rate limiting:

from time import sleep
import requests

def rate_limited_call(endpoint, data):
    response = requests.post(endpoint, json=data, headers=headers)

    # Check rate limit headers
    remaining = int(response.headers.get("X-RateLimit-Remaining", 0))

    if remaining < 10:
        sleep(1) # Throttle requests

    return response.json()

Error Handling

Don’t expose sensitive errors to end users: Bad:

try:
    result = fincept_api_call()
except Exception as e:
    return str(e) #  May expose API key or internal details

Good:

try:
    result = fincept_api_call()
except Exception as e:
    logger.error(f"API error: {e}") # Log internally
    return {"error": "Operation failed"} #  Generic message

Team Security

Separate Keys per Environment

Environment	Account	Key
Development	[email protected]	fk_user_dev_key
Staging	[email protected]	fk_user_staging_key
Production	[email protected]	fk_user_prod_key

Access Control

🔐 Limit key access to necessary team members
📝 Document who has access to which keys
🔄 Rotate when team members leave
📊 Audit key usage regularly

CI/CD Secrets

Use secret management in pipelines: GitHub Actions:

- name: Run tests
  env:
    FINCEPT_API_KEY: ${{ secrets.FINCEPT_API_KEY }}
  run: pytest

GitLab CI:

test:
  script:
    - export FINCEPT_API_KEY=$FINCEPT_API_KEY
    - pytest

Incident Response

If Key is Compromised

Regenerate Immediately

curl -X POST https://finceptbackend.share.zrok.io/user/regenerate-api-key \
  -H "X-API-Key: fk_user_old_key"

Check Login History

Look for unauthorized access

Review Usage

Check for unusual API calls

Update Applications

Deploy new key to all services

Enable MFA

Add extra protection

Contact Support

Report incident to [email protected]

If Account is Compromised

Change password immediately
Regenerate API key
Review and cancel suspicious transactions
Check login history for unauthorized access
Enable MFA
Contact [email protected]

Compliance

Data Protection

Fincept complies with:

GDPR (General Data Protection Regulation)
PCI DSS (Payment Card Industry standards)
SOC 2 Type II (in progress)
ISO 27001 (planned)

Your Responsibilities

When using Fincept API:

🔐 Protect your API keys
📊 Secure data received from API
🔒 Encrypt sensitive information
📝 Comply with local regulations
🚨 Report security incidents

Security Checklist

Reporting Security Issues

Found a security vulnerability? Contact: [email protected] Include:

Detailed description
Steps to reproduce
Potential impact
Your contact information

Do NOT:

Publicly disclose vulnerabilities
Test on production systems without permission
Share exploit code publicly

We’ll respond within 24 hours and credit researchers who report responsibly.

Next Steps

API Keys Guide

Learn key management best practices

MFA Setup

Enable multi-factor authentication

Error Handling

Handle errors securely

Rate Limits

Understand rate limiting

Get Started

Authentication & Security

Pricing & Credits

Core Concepts

QuantLib Overview

Module Guides

Examples & Use Cases

Advanced Topics

​Security Best Practices

​API Key Security

​Never Expose Keys Publicly

​Store Securely

​Password Security

​Strong Password Requirements

​Password Don’ts

​Password Manager

​Account Security

​Enable MFA

​Monitor Login Activity

​Rotate API Keys

​Network Security

​HTTPS Only

​Firewall Rules

​VPN/Private Networks

​Application Security

​Validate Input

​Rate Limiting

​Error Handling

​Team Security

​Separate Keys per Environment

​Access Control

​CI/CD Secrets

​Incident Response

​If Key is Compromised

​If Account is Compromised

​Compliance

​Data Protection

​Your Responsibilities

​Security Checklist

​Reporting Security Issues

​Next Steps

API Keys Guide

MFA Setup

Error Handling

Rate Limits

Security Best Practices

API Key Security

Never Expose Keys Publicly

Store Securely

Password Security

Strong Password Requirements

Password Don’ts

Password Manager

Account Security

Enable MFA

Monitor Login Activity

Rotate API Keys

Network Security

HTTPS Only

Firewall Rules

VPN/Private Networks

Application Security

Validate Input

Rate Limiting

Error Handling

Team Security

Separate Keys per Environment

Access Control

CI/CD Secrets

Incident Response

If Key is Compromised

If Account is Compromised

Compliance

Data Protection

Your Responsibilities

Security Checklist

Reporting Security Issues

Next Steps