> ## Documentation Index
> Fetch the complete documentation index at: https://docs.fincept.in/llms.txt
> Use this file to discover all available pages before exploring further.

# Security Best Practices

> Comprehensive security guidelines for protecting your API keys and account

# Security Best Practices

Protect your Fincept account, API keys, and financial data with these security guidelines.

## API Key Security

### Never Expose Keys Publicly

<AccordionGroup>
  <Accordion title=" Don't Commit to Version Control">
    **Bad:**

    ```python theme={null}
    # config.py
    API_KEY = "fk_user_Hy8kL2mN9pQ1..." #  NEVER DO THIS
    ```

    **Good:**

    ```python theme={null}
    # config.py
    import os
    API_KEY = os.getenv("FINCEPT_API_KEY") #  Use environment variables
    ```

    Add to `.gitignore`:

    ```
    .env
    .env.local
    config.json
    secrets.*
    *.key
    ```
  </Accordion>

  <Accordion title=" Don't Hardcode in Frontend">
    **Bad:**

    ```javascript theme={null}
    // app.js - Client-side code
    const API_KEY = "fk_user_Hy8kL2mN9pQ1..."; //  Exposed to users!
    ```

    **Good:**

    ```javascript theme={null}
    // backend/server.js - Server-side only
    const API_KEY = process.env.FINCEPT_API_KEY; //  Secure
    ```

    <Warning>
      **Never** expose API keys in client-side JavaScript, mobile apps, or browser code!
    </Warning>
  </Accordion>

  <Accordion title=" Don't Share in Public Forums">
    When sharing code snippets in GitHub issues, Stack Overflow, or Discord:

    **Bad:**

    ```bash theme={null}
    curl -H "X-API-Key: fk_user_abc123..." #  Real key visible
    ```

    **Good:**

    ```bash theme={null}
    curl -H "X-API-Key: YOUR_API_KEY_HERE" #  Placeholder
    ```
  </Accordion>

  <Accordion title=" Don't Log Keys">
    **Bad:**

    ```python theme={null}
    logger.info(f"Using API key: {API_KEY}") #  Logged
    ```

    **Good:**

    ```python theme={null}
    logger.info(f"Using API key: {API_KEY[:10]}***") #  Redacted
    ```
  </Accordion>
</AccordionGroup>

### Store Securely

<Tabs>
  <Tab title="Environment Variables">
    **Linux/macOS (.bashrc or .zshrc):**

    ```bash theme={null}
    export FINCEPT_API_KEY="fk_user_your_key"
    ```

    **Windows (System Environment):**

    ```powershell theme={null}
    setx FINCEPT_API_KEY "fk_user_your_key"
    ```

    **.env file (with python-dotenv):**

    ```bash theme={null}
    FINCEPT_API_KEY=fk_user_your_key
    ```

    ```python theme={null}
    from dotenv import load_dotenv
    load_dotenv()

    API_KEY = os.getenv("FINCEPT_API_KEY")
    ```
  </Tab>

  <Tab title="Secret Managers">
    **AWS Secrets Manager:**

    ```python theme={null}
    import boto3

    client = boto3.client('secretsmanager')
    secret = client.get_secret_value(SecretId='fincept/api-key')
    API_KEY = secret['SecretString']
    ```

    **HashiCorp Vault:**

    ```python theme={null}
    import hvac

    client = hvac.Client(url='https://vault.company.com')
    secret = client.secrets.kv.v2.read_secret_version(path='fincept/api-key')
    API_KEY = secret['data']['data']['key']
    ```

    **Azure Key Vault:**

    ```python theme={null}
    from azure.keyvault.secrets import SecretClient

    client = SecretClient(vault_url="https://myvault.vault.azure.net", credential=credential)
    API_KEY = client.get_secret("fincept-api-key").value
    ```
  </Tab>

  <Tab title="Config Files">
    **config.json (not committed):**

    ```json theme={null}
    {
      "fincept_api_key": "fk_user_your_key"
    }
    ```

    **Add to .gitignore:**

    ```
    config.json
    config.*.json
    secrets.json
    ```

    **Load in code:**

    ```python theme={null}
    import json

    with open('config.json') as f:
        config = json.load(f)
    API_KEY = config['fincept_api_key']
    ```
  </Tab>
</Tabs>

## Password Security

### Strong Password Requirements

<Checklist>
  <Check> At least 8 characters long</Check>
  <Check> Contains uppercase letters (A-Z)</Check>
  <Check> Contains lowercase letters (a-z)</Check>
  <Check> Contains numbers (0-9)</Check>
  <Check> Unique to Fincept (not reused)</Check>
  <Check> Bonus: Special characters (!@#\$%)</Check>
</Checklist>

### Password Don'ts

* Don't use dictionary words
* Don't use personal information
* Don't reuse passwords from other sites
* Don't share with team members
* Don't write down on paper
* Don't email passwords

### Password Manager

Use password managers to generate and store strong passwords:

* **1Password** - Enterprise-ready
* **Bitwarden** - Open-source
* **LastPass** - Popular choice
* **Dashlane** - User-friendly

## Account Security

### Enable MFA

**Always enable** on production accounts:

```bash theme={null}
curl -X POST https://api.fincept.in/user/mfa/enable \
  -H "X-API-Key: fk_user_your_key"
```

[Learn more about MFA →](/mfa-setup)

### Monitor Login Activity

Check regularly for suspicious logins:

```bash theme={null}
curl https://api.fincept.in/user/login-history \
  -H "X-API-Key: fk_user_your_key"
```

**Look for:**

* 🚨 Unfamiliar IP addresses
* 🚨 Unusual login times
* 🚨 Failed login attempts
* 🚨 Multiple failed MFA attempts

### Rotate API Keys

Regenerate keys periodically:

| Account Type | Recommended Rotation |
| ------------ | -------------------- |
| Development  | Every 180 days       |
| Production   | Every 90 days        |
| Enterprise   | Every 30-60 days     |
| Compromised  | Immediately!         |

## Network Security

### HTTPS Only

**Always** use HTTPS, never HTTP:

`https://api.fincept.in`

### Firewall Rules

Restrict outbound API calls to Fincept domain:

```bash theme={null}
# Allow only Fincept API
iptables -A OUTPUT -d api.fincept.in -j ACCEPT
```

### VPN/Private Networks

For sensitive operations:

* Use VPN for remote access
* Restrict API access to corporate networks
* Implement IP whitelisting (enterprise feature)

## Application Security

### Validate Input

Never pass user input directly to API:

**Bad:**

```python theme={null}
# User can inject malicious values
user_input = request.get("strike")
api_call(strike=user_input) #  Dangerous
```

**Good:**

```python theme={null}
# Validate and sanitize
try:
    strike = float(request.get("strike"))
    if strike <= 0 or strike > 1000000:
        raise ValueError("Invalid strike")
    api_call(strike=strike) #  Safe
except ValueError:
    return {"error": "Invalid input"}
```

### Rate Limiting

Implement client-side rate limiting:

```python theme={null}
from time import sleep
import requests

def rate_limited_call(endpoint, data):
    response = requests.post(endpoint, json=data, headers=headers)

    # Check rate limit headers
    remaining = int(response.headers.get("X-RateLimit-Remaining", 0))

    if remaining < 10:
        sleep(1) # Throttle requests

    return response.json()
```

### Error Handling

Don't expose sensitive errors to end users:

**Bad:**

```python theme={null}
try:
    result = fincept_api_call()
except Exception as e:
    return str(e) #  May expose API key or internal details
```

**Good:**

```python theme={null}
try:
    result = fincept_api_call()
except Exception as e:
    logger.error(f"API error: {e}") # Log internally
    return {"error": "Operation failed"} #  Generic message
```

## Team Security

### Separate Keys per Environment

| Environment | Account                                           | Key                    |
| ----------- | ------------------------------------------------- | ---------------------- |
| Development | [dev@company.com](mailto:dev@company.com)         | fk\_user\_dev\_key     |
| Staging     | [staging@company.com](mailto:staging@company.com) | fk\_user\_staging\_key |
| Production  | [prod@company.com](mailto:prod@company.com)       | fk\_user\_prod\_key    |

### Access Control

* 🔐 Limit key access to necessary team members
* 📝 Document who has access to which keys
* 🔄 Rotate when team members leave
* 📊 Audit key usage regularly

### CI/CD Secrets

Use secret management in pipelines:

**GitHub Actions:**

```yaml theme={null}
- name: Run tests
  env:
    FINCEPT_API_KEY: ${{ secrets.FINCEPT_API_KEY }}
  run: pytest
```

**GitLab CI:**

```yaml theme={null}
test:
  script:
    - export FINCEPT_API_KEY=$FINCEPT_API_KEY
    - pytest
```

## Incident Response

### If Key is Compromised

<Steps>
  <Step title="Regenerate Immediately">
    ```bash theme={null}
    curl -X POST https://api.fincept.in/user/regenerate-api-key \
      -H "X-API-Key: fk_user_old_key"
    ```
  </Step>

  <Step title="Check Login History">
    Look for unauthorized access
  </Step>

  <Step title="Review Usage">
    Check for unusual API calls
  </Step>

  <Step title="Update Applications">
    Deploy new key to all services
  </Step>

  <Step title="Enable MFA">
    Add extra protection
  </Step>

  <Step title="Contact Support">
    Report incident to [support@fincept.in](mailto:support@fincept.in)
  </Step>
</Steps>

### If Account is Compromised

1. **Change password immediately**
2. **Regenerate API key**
3. **Review and cancel suspicious transactions**
4. **Check login history for unauthorized access**
5. **Enable MFA**
6. **Contact [support@fincept.in](mailto:support@fincept.in)**

## Compliance

### Data Protection

Fincept complies with:

* GDPR (General Data Protection Regulation)
* PCI DSS (Payment Card Industry standards)
* SOC 2 Type II (in progress)
* ISO 27001 (planned)

### Your Responsibilities

When using Fincept API:

* 🔐 Protect your API keys
* 📊 Secure data received from API
* 🔒 Encrypt sensitive information
* 📝 Comply with local regulations
* 🚨 Report security incidents

## Security Checklist

<Checklist>
  <Check> API key stored in environment variables</Check>
  <Check> Keys excluded from version control</Check>
  <Check> MFA enabled on production accounts</Check>
  <Check> Strong, unique password used</Check>
  <Check> Login history monitored regularly</Check>
  <Check> Separate keys per environment</Check>
  <Check> Client-side rate limiting implemented</Check>
  <Check> Error messages sanitized</Check>
  <Check> HTTPS enforced</Check>
  <Check> Key rotation schedule defined</Check>
</Checklist>

## Reporting Security Issues

Found a security vulnerability?

**Contact:** [security@fincept.in](mailto:security@fincept.in)

**Include:**

* Detailed description
* Steps to reproduce
* Potential impact
* Your contact information

**Do NOT:**

* Publicly disclose vulnerabilities
* Test on production systems without permission
* Share exploit code publicly

We'll respond within 24 hours and credit researchers who report responsibly.

## Next Steps

<CardGroup cols={2}>
  <Card title="API Keys Guide" icon="key" href="/api-keys">
    Learn key management best practices
  </Card>

  <Card title="MFA Setup" icon="shield" href="/mfa-setup">
    Enable multi-factor authentication
  </Card>

  <Card title="Error Handling" icon="triangle-exclamation" href="/error-handling">
    Handle errors securely
  </Card>

  <Card title="Rate Limits" icon="gauge" href="/rate-limits">
    Understand rate limiting
  </Card>
</CardGroup>