Added security checks, updated README.md to reflect that

Dockerfile

@@ -7,12 +7,17 @@ WORKDIR /app
 
 # Install dependencies
 COPY requirements.txt .
-RUN pip install --no-cache-dir huggingface_hub llama-cpp-python gunicorn flask requests
-
+RUN pip install --no-cache-dir huggingface_hub llama-cpp-python gunicorn flask requests python-dotenv
 COPY . .
 
 # Railway uses the PORT env var
 ENV PORT=8080
 EXPOSE 8080
 
+#creates user appuser and sets ownership of /app to that user
+RUN useradd -m appuser
+RUN chown -R appuser:appuser /app
+
+USER appuser
+
 CMD ["gunicorn", "--bind", "0.0.0.0:8080", "backend.app:app"]

README.md

@@ -33,6 +33,21 @@ This assistant provides high-quality coding intelligence within a constrained 2G
 ├── memory.db # SQLite chat history database
 └── README.md
 
+---
+## 🔒 Security & Hardening
+
+This project incorporates robust security controls tailored for public cloud deployments:
+
+1. Authentication: All sensitive mutation and inference routes require a valid X-API-Key header matched against environment variables.
+
+2. Rate Limiting: Custom IP-based rate tracking returns HTTP 429 (Too Many Requests) status codes if thresholds are exceeded.
+
+3. Verification: to verify the security implementation run sec_test.py:
+
+    ```bash
+    python sec_test.py
+    ```
+
 ---
 
 ## Deployment (Railway)
@@ -40,6 +55,7 @@ This assistant provides high-quality coding intelligence within a constrained 2G
 1. Mount Volumes: Create a volume and mount it to /app/data and /app/models.
 
 2. Environment Variables:
+   - `API_KEY`: Your secret key for API verification.
    - `PORT`: 8080
    - `PYTHONUNBUFFERED`: 1
 

backend/app.py

@@ -2,16 +2,48 @@ import os
 import re
 import glob
 import time
-import json
+import functools
 import sqlite3
 import subprocess
-from typing import List, Dict, Tuple, Optional
+from typing import List, Tuple, Optional
 from flask import Flask, request, jsonify, render_template, Response, abort
 import requests
 from werkzeug.utils import secure_filename
 from llama_cpp import Llama
 from huggingface_hub import hf_hub_download
-
+from dotenv import load_dotenv
+
+load_dotenv()
+
+API_KEYS = os.getenv("API_KEY")
+# Security:
+RATE_LIMIT = 10  # 10 requests per minute
+REQUEST_COUNTS = {}
+# rate limiting decorator
+def rate_limit(func):
+    @functools.wraps(func)
+    def wrapper(*args, **kwargs):
+        client_ip = request.remote_addr  # Get the client's IP address
+        now = time.time()
+        if client_ip not in REQUEST_COUNTS:
+            REQUEST_COUNTS[client_ip] = {"count": 0, "timestamp": now}
+        if now - REQUEST_COUNTS[client_ip]["timestamp"] > 60:  # Reset count after 1 minute
+            REQUEST_COUNTS[client_ip] = {"count": 0, "timestamp": now}
+        if REQUEST_COUNTS[client_ip]["count"] >= RATE_LIMIT:
+            abort(429)  # Too Many Requests
+        REQUEST_COUNTS[client_ip]["count"] += 1
+        return func(*args, **kwargs)
+    return wrapper
+#api key decorator
+def require_api_key(func):
+    @functools.wraps(func)
+    def wrapper(*args, **kwargs):
+        api_key = request.headers.get('X-API-Key')  # Assuming key is sent in header
+        if api_key and api_key == API_KEYS:
+            return func(*args, **kwargs)
+        else:
+            abort(401)  # Unauthorized
+    return wrapper
 # --- Cloud Config ---
 # We use a 1.5B model so it doesn't crash Railway's free RAM (approx 2GB)
 REPO_ID = "Qwen/Qwen2.5-Coder-0.5B-Instruct-GGUF"
@@ -28,9 +60,8 @@ if not os.path.exists(model_path):
     hf_hub_download(repo_id=REPO_ID, filename=FILENAME, local_dir="/app/models")
 
 # Initialize LLM
-llm = Llama(model_path=model_path, n_ctx=4012, n_threads=4, n_batch=512, flash_attn=True)
+llm = Llama(model_path=model_path, n_ctx=8192, n_threads=4, n_batch=512, flash_attn=True)
 
-# Update your DB_PATH to use the persistent volume
 DB_PATH = "/app/data/memory.db"
 PROJECTS_DIR = os.getenv("PROJECTS_DIR", "./projects")
 
@@ -346,8 +377,14 @@ IMPORTANT:
 
 # -------------- Routes --------------
 @app.route("/")
+@rate_limit
 def index():
-    return render_template("index.html")
+    return render_template("index.html", api_key=API_KEYS)
+
+@app.route("/protected")
+@require_api_key
+def protected_resource():
+    return "This is a protected resource!"
 
 @app.route("/history/<project>", methods=["GET"])
 def get_history(project):
@@ -376,6 +413,7 @@ def get_projects():
     return jsonify([r[0] for r in rows])
 
 @app.route("/settings", methods=["GET", "POST"])
+@require_api_key
 def settings():
     """Get or update runtime settings without redeploy."""
     global MODEL, TEMPERATURE, TOP_P, NUM_CTX, SEED
@@ -405,6 +443,7 @@ def add_project():
     return jsonify({"status": "ok", "project": project})
 
 @app.route("/chat", methods=["POST"])
+@require_api_key
 def chat():
     data = request.json or {}
     project = data.get("project", "default")
@@ -435,6 +474,8 @@ def chat():
     return jsonify({"response": assistant_text, "saved_files": saved_files})
 
 @app.route("/stream", methods=["POST"])
+@require_api_key
+@rate_limit
 def stream():
     data = request.json or {}
     project = data.get("project", "default")
@@ -477,6 +518,8 @@ def stream():
     return resp
 
 @app.route("/search_web", methods=["POST"])
+@require_api_key
+@rate_limit
 def search_web():
     data = request.json or {}
     query = (data.get("query") or "").strip()
@@ -504,6 +547,8 @@ def allowed_file(filename):
     return "." in filename and filename.rsplit(".", 1)[1].lower() in ALLOWED_EXTENSIONS
 
 @app.route("/upload_file/<project>", methods=["POST"])
+@require_api_key
+@rate_limit
 def upload_file(project):
     if "file" not in request.files:
         return jsonify({"error": "no file part"}), 400
@@ -521,6 +566,7 @@ def upload_file(project):
         return jsonify({"error": "file type not allowed"}), 400
 
 @app.route("/delete_project", methods=["POST"])
+@require_api_key
 def delete_project():
     data = request.json or {}
     project = (data.get("project") or "").strip()
@@ -554,6 +600,8 @@ def _run_cmd(cmd: List[str], cwd: Optional[str] = None, timeout: int = 20) -> Tu
         return 1, "", str(e)
 
 @app.route("/run/<project>", methods=["POST"])
+@require_api_key
+@rate_limit
 def run_project(project):
     if not RUNNER_ENABLED:
         return jsonify({"error": "runner disabled; set RUNNER_ENABLED=1"}), 400
@@ -569,6 +617,8 @@ def run_project(project):
     return jsonify({"code": code, "stdout": out, "stderr": err})
 
 @app.route("/lint/<project>", methods=["POST"])
+@require_api_key
+@rate_limit
 def lint(project):
     if not LINTER_ENABLED:
         return jsonify({"error": "linter disabled; set LINTER_ENABLED=1"}), 400

sec_test.py

@@ -0,0 +1,139 @@
+"""
+Qwen Coder API - Security Test Script
+
+Tests:
+  1. Protected routes reject requests with no API key (401)
+  2. Protected routes reject requests with a WRONG key (401) - this also
+     re-confirms the substring-bypass bug is actually fixed (see test 3)
+  3. A key that's a SUBSTRING of the real one is rejected (401) - this is
+     the specific bug we found and fixed (the old `in` comparison would
+     have let this one through)
+  4. Protected routes accept requests with the CORRECT key (200)
+  5. Rate limiting kicks in after RATE_LIMIT requests within 60s (429)
+  6. Flags routes that are currently unprotected (/add_project, /cancel)
+     so you don't forget they're still open
+
+Usage:
+    python test_security.py --url http://localhost:8080 --key YOUR_REAL_API_KEY
+
+Or, to read the key from your .env file automatically:
+    pip install python-dotenv
+    python test_security.py --url http://localhost:8080
+"""
+
+import argparse
+import requests
+
+try:
+    from dotenv import load_dotenv
+    import os
+    load_dotenv()
+except ImportError:
+    pass
+
+
+PASS = "\033[92mPASS\033[0m"
+FAIL = "\033[91mFAIL\033[0m"
+WARN = "\033[93mWARN\033[0m"
+
+
+def check(label: str, condition: bool, detail: str = ""):
+    status = PASS if condition else FAIL
+    print(f"  [{status}] {label}" + (f" — {detail}" if detail else ""))
+    return condition
+
+
+def test_no_key(base_url: str):
+    print("\n1. Requests with NO API key should be rejected (401)")
+    r = requests.post(f"{base_url}/add_project", json={"project": "test_no_key"})
+    if r.status_code == 401:
+        check("/add_project rejects missing key", True)
+    else:
+        print(f"  [{WARN}] /add_project has no auth protection yet (got {r.status_code}, not 401) — known open item")
+
+    r = requests.post(f"{base_url}/chat", json={"project": "default", "message": "hi"})
+    check("/chat rejects missing key", r.status_code == 401, f"got {r.status_code}")
+
+
+def test_wrong_key(base_url: str, real_key: str):
+    print("\n2. Requests with a WRONG key should be rejected (401)")
+    r = requests.post(
+        f"{base_url}/chat",
+        json={"project": "default", "message": "hi"},
+        headers={"X-API-Key": "definitely-not-the-real-key"},
+    )
+    check("/chat rejects wrong key", r.status_code == 401, f"got {r.status_code}")
+
+
+def test_substring_bug(base_url: str, real_key: str):
+    print("\n3. A SUBSTRING of the real key should be rejected (the original bug)")
+    if len(real_key) < 4:
+        print(f"  [{WARN}] Real key too short to meaningfully test substring bypass, skipping")
+        return
+    substring_key = real_key[: max(3, len(real_key) // 3)]
+    r = requests.post(
+        f"{base_url}/chat",
+        json={"project": "default", "message": "hi"},
+        headers={"X-API-Key": substring_key},
+    )
+    check(
+        "/chat rejects a substring of the real key",
+        r.status_code == 401,
+        f"sent '{substring_key}...', got {r.status_code} (200 here would mean the old bug is back)",
+    )
+
+
+def test_correct_key(base_url: str, real_key: str):
+    print("\n4. Requests WITH the correct key should succeed")
+    r = requests.post(f"{base_url}/add_project", json={"project": "test_correct_key"})
+    r2 = requests.post(
+        f"{base_url}/chat",
+        json={"project": "test_correct_key", "message": "Say hello in one word."},
+        headers={"X-API-Key": real_key},
+    )
+    check("/chat accepts the correct key", r2.status_code == 200, f"got {r2.status_code}: {r2.text[:200]}")
+
+
+def test_rate_limit(base_url: str, real_key: str, rate_limit: int):
+    print(f"\n5. Rate limiting should trigger after {rate_limit} requests/minute")
+    hit_429 = False
+    for i in range(rate_limit + 3):
+        r = requests.post(
+            f"{base_url}/search_web",
+            json={"query": "test"},
+            headers={"X-API-Key": real_key},
+        )
+        if r.status_code == 429:
+            hit_429 = True
+            check("Rate limit triggered", True, f"hit 429 on request #{i + 1}")
+            break
+    if not hit_429:
+        check("Rate limit triggered", False, f"never got a 429 after {rate_limit + 3} requests")
+
+
+def test_open_routes(base_url: str):
+    print("\n6. Checking currently-unprotected routes (informational, not pass/fail)")
+    r = requests.post(f"{base_url}/cancel")
+    if r.status_code != 401:
+        print(f"  [{WARN}] /cancel has no auth protection (got {r.status_code}) — decide if this needs one")
+
+
+if __name__ == "__main__":
+    parser = argparse.ArgumentParser()
+    parser.add_argument("--url", default="http://localhost:8080", help="Base URL of the running app")
+    parser.add_argument("--key", default=None, help="Your real API_KEY (or set it in .env)")
+    parser.add_argument("--rate-limit", type=int, default=10, help="Expected RATE_LIMIT value from app.py")
+    args = parser.parse_args()
+
+    real_key = args.key or os.getenv("API_KEY")
+    if not real_key:
+        raise SystemExit("No API key provided. Use --key YOUR_KEY or set API_KEY in a .env file.")
+
+    print(f"=== Testing {args.url} ===")
+    test_no_key(args.url)
+    test_wrong_key(args.url, real_key)
+    test_substring_bug(args.url, real_key)
+    test_correct_key(args.url, real_key)
+    test_rate_limit(args.url, real_key, args.rate_limit)
+    test_open_routes(args.url)
+    print("\nDone.")

static/script.js

@@ -9,7 +9,22 @@ const deleteProjectBtn = document.getElementById("deleteProject");
 
 let currentAbortController = null;
 
-// ---------- NEW: Project History Loading ----------
+// ---------- API Key Management ----------
+function getApiKey() {
+  return window.APP_API_KEY || "";
+}
+
+function getHeaders(includeContentType = true) {
+  const headers = {
+    "X-API-Key": getApiKey()
+  };
+  if (includeContentType) {
+    headers["Content-Type"] = "application/json";
+  }
+  return headers;
+}
+
+// ---------- Project History Loading ----------
 
 async function loadHistory(project) {
   chatDiv.innerHTML = '<div class="message assistant"><em>Loading history...</em></div>';
@@ -25,13 +40,11 @@ async function loadHistory(project) {
         if (msg.role === "user") {
           appendAndScroll(makeUserNode(msg.content));
         } else {
-          // Assistant messages need markdown parsing
           const node = makeAssistantNode();
           node.innerHTML = `<strong>Assistant:</strong><br>${marked.parse(msg.content)}`;
           appendAndScroll(node);
         }
       });
-      // Re-highlight all code blocks after loading
       if (typeof hljs !== 'undefined') hljs.highlightAll();
     } else {
       chatDiv.innerHTML = '<div class="message assistant"><em>New project started. No history found.</em></div>';
@@ -42,7 +55,6 @@ async function loadHistory(project) {
   }
 }
 
-// Listen for dropdown changes
 projectSelect.addEventListener("change", () => {
   loadHistory(projectSelect.value);
 });
@@ -81,26 +93,33 @@ async function refreshProjects() {
     projectSelect.appendChild(opt);
   });
 
-  // Keep selection if it still exists, otherwise load the first project
   if (data.includes(currentVal)) {
     projectSelect.value = currentVal;
   } else if (data.length > 0) {
     projectSelect.value = data[0];
-    loadHistory(data[0]); // Load history for the initial project
+    loadHistory(data[0]);
   }
 }
 
 addProjectBtn.addEventListener("click", async () => {
   const name = prompt("Project Name:");
   if (!name) return;
-  await fetch(`/add_project/${name}`, { method: "POST" });
+  await fetch(`/add_project`, { 
+    method: "POST", 
+    headers: getHeaders(),
+    body: JSON.stringify({ project: name })
+  });
   await refreshProjects();
 });
 
 deleteProjectBtn.addEventListener("click", async () => {
   const p = projectSelect.value;
   if (!p || !confirm(`Delete project ${p}?`)) return;
-  await fetch(`/delete_project/${p}`, { method: "DELETE" });
+  await fetch(`/delete_project`, { 
+    method: "POST", 
+    headers: getHeaders(),
+    body: JSON.stringify({ project: p })
+  });
   await refreshProjects();
 });
 
@@ -126,8 +145,9 @@ sendBtn.addEventListener("click", async () => {
       assistantNode.innerHTML = `<strong>Assistant:</strong><br><em>Searching web...</em>`;
       const sResp = await fetch("/search_web", {
         method: "POST",
-        headers: { "Content-Type": "application/json" },
-        body: JSON.stringify({ query: text })
+        headers: getHeaders(),
+        body: JSON.stringify({ query: text }),
+        signal: currentAbortController.signal
       });
       const sData = await sResp.json();
       search_results = sData.results || [];
@@ -135,7 +155,7 @@ sendBtn.addEventListener("click", async () => {
 
     const res = await fetch("/chat", {
       method: "POST",
-      headers: { "Content-Type": "application/json" },
+      headers: getHeaders(),
       body: JSON.stringify({ project, message: text, search_results }),
       signal: currentAbortController.signal
     });
@@ -159,7 +179,6 @@ sendBtn.addEventListener("click", async () => {
   }
 });
 
-// Clear UI only (doesn't delete database)
 clearBtn.addEventListener("click", () => {
   chatDiv.innerHTML = "";
 });
@@ -174,7 +193,15 @@ async function uploadFile(project) {
   formData.append("file", fileInput.files[0]);
 
   try {
-    const res = await fetch(`/upload_file/${project}`, { method: "POST", body: formData });
+    // Do not set Content-Type header when uploading FormData so the browser automatically handles the boundary
+    const headers = {
+      "X-API-Key": getApiKey()
+    };
+    const res = await fetch(`/upload_file/${project}`, { 
+      method: "POST", 
+      headers: headers,
+      body: formData 
+    });
     const data = await res.json();
     if (data.status === "ok") {
       alert(`Uploaded: ${data.filename}`);
@@ -187,10 +214,8 @@ async function uploadFile(project) {
   }
 }
 
-// Ctrl+Enter support
 promptInput.addEventListener("keydown", (e) => {
   if (e.ctrlKey && e.key === "Enter") sendBtn.click();
 });
 
-// Initial Init
 refreshProjects();

templates/index.html

@@ -39,7 +39,9 @@
     // Initialize Markdown and Code Highlighting
     marked.setOptions({ gfm: true, breaks: true });
   </script>
-
+  <script>
+  window.APP_API_KEY = "{{ api_key }}";
+  </script>
   <script src="{{ url_for('static', filename='script.js') }}"></script>
 </body>
 </html>