deepchat

Least-privilege permissions

• Never paste API keys directly into the chat application. API keys are like master passwords—if exposed, attackers gain full access to your AI service and billing. Always use a secure intermediary server that holds keys privately and gives the app temporary, limited-access tokens instead.
• Restrict what the AI can do. Configure the deepchat settings to limit which AI models or actions it can perform, and disable any features you don't actually need (e.g., file uploads, external integrations).
• Use separate API keys per environment. Keep different keys for testing, staging, and production so a compromise in one doesn't expose everything.

Network isolation

• Route all AI requests through your own secure server, not directly to external AI providers. This acts as a security checkpoint where you can inspect and filter harmful requests before they leave your network.
• Disable client-side storage of chat history if possible. Conversations stored on users' devices or in browser caches can leak sensitive business data; verify that deepchat is configured to keep chats in memory only (not saved to disk).
• Audit third-party integrations listed in your deepchat configuration. Every connected service (OpenAI, Anthropic, etc.) is another potential entry point; disable integrations you don't use and review their privacy policies for data residency and GDPR compliance.

Monitoring

• Log all API calls made by deepchat (requests, responses, and who triggered them) and review logs weekly for unusual patterns, repeated errors, or unexpected data access.
• Set up billing alerts on your connected AI services to catch sudden spikes that might indicate unauthorized use or a security breach.
• Track which users access deepchat and when, and flag repeated failed authentication attempts or access outside normal business hours.

Red flags to watch for

• Responses that contradict your company policies or contain confidential information you never fed to the AI. This suggests the system prompt has been bypassed or the AI was previously trained on leaked data.
• Users receiving inconsistent or "jailbroken" answers from the same question (e.g., the AI suddenly ignoring safety guidelines). This indicates prompt injection attacks.
• Unexpected charges on your AI service bill or API quota warnings. This suggests the app is making excessive requests, possibly due to a misconfiguration, bot attack, or compromise.
• deepchat receiving updates with no security advisory or the package showing zero downloads/maintenance. Low adoption means fewer eyes on the code; treat updates cautiously and audit dependencies before deploying.