Security hardening: rate limiting, no creds in URLs, path traversal fix

Critical fixes from security audit:
- Move API key from query params to Authorization header (never logged)
- Add per-IP rate limiting (20 LLM requests/hour)
- Cap parallel workers at 10 to prevent abuse
- Fix Nemotron path traversal (must be within project or /tmp)
- Disable uvicorn access log to prevent credential leakage
- Remove filesystem paths from /api/config response
- Fix Dockerfile: add git for HF Spaces build
- Update privacy claim to accurately describe key handling

Dockerfile

@@ -1,9 +1,10 @@
 FROM python:3.11-slim
 
+RUN apt-get update && apt-get install -y --no-install-recommends git && rm -rf /var/lib/apt/lists/*
+
 WORKDIR /app
 
 # Install dependencies
-COPY pyproject.toml .
 RUN pip install --no-cache-dir \
     "datasets>=4.0.0" \
     "huggingface_hub>=0.20.0" \

web/app.py

@@ -138,17 +138,43 @@ def _llm_from_params(api_key: str = "", base_url: str = "", model: str = ""):
     )
 
 
+# Rate limiting — per-IP request counter
+_rate_limits: dict = {}  # ip -> {"count": N, "reset": timestamp}
+RATE_LIMIT_MAX = 20  # LLM requests per window
+RATE_LIMIT_WINDOW = 3600  # 1 hour
+
+
+def _check_rate_limit(ip: str):
+    """Raise 429 if IP has exceeded rate limit."""
+    now = time.time()
+    entry = _rate_limits.get(ip)
+    if not entry or now > entry["reset"]:
+        _rate_limits[ip] = {"count": 1, "reset": now + RATE_LIMIT_WINDOW}
+        return
+    if entry["count"] >= RATE_LIMIT_MAX:
+        raise HTTPException(429, f"Rate limit exceeded. Try again in {int(entry['reset'] - now)}s.")
+    entry["count"] += 1
+
+
 @app.middleware("http")
 async def inject_llm_config(request: Request, call_next):
-    """Make LLM creds available from query params on any request."""
-    request.state.api_key = request.query_params.get("api_key", "")
-    request.state.base_url = request.query_params.get("base_url", "")
-    request.state.model = request.query_params.get("model", "")
+    """Read LLM creds from Authorization header (not query params — those get logged)."""
+    # Authorization: Bearer <api_key>|<base_url>|<model>  (pipe-separated)
+    auth = request.headers.get("authorization", "")
+    if auth.startswith("Bearer "):
+        parts = auth[7:].split("|", 2)
+        request.state.api_key = parts[0] if len(parts) > 0 else ""
+        request.state.base_url = parts[1] if len(parts) > 1 else ""
+        request.state.model = parts[2] if len(parts) > 2 else ""
+    else:
+        request.state.api_key = ""
+        request.state.base_url = ""
+        request.state.model = ""
     return await call_next(request)
 
 
 def llm_from_request(request: Request):
-    """Get LLM client+model from the current request's query params."""
+    """Get LLM client+model from the current request. Never logs credentials."""
     return _llm_from_params(
         request.state.api_key, request.state.base_url, request.state.model
     )
@@ -210,7 +236,6 @@ async def get_config():
         "model": get_model(),
         "has_api_key": has_key,
         "base_url": os.getenv("LLM_BASE_URL", ""),
-        "nemotron_path": str(nem_path) if nem_path else None,
         "nemotron_available": nem_path is not None,
         "is_spaces": IS_SPACES,
         "persona_datasets": list(NEMOTRON_DATASETS.keys()),
@@ -233,6 +258,9 @@ class NemotronPathInput(BaseModel):
 async def setup_nemotron(input: NemotronPathInput):
     """Point to existing data, or download a Nemotron dataset to the given path."""
     p = Path(input.path).expanduser().resolve()
+    # Prevent path traversal — must be within project or /tmp
+    if not (p.is_relative_to(PROJECT_ROOT) or p.is_relative_to(Path("/tmp"))):
+        raise HTTPException(403, "Path must be within the project directory")
     hf_name = NEMOTRON_DATASETS.get(input.dataset, NEMOTRON_DATASETS["USA"])
 
     if (p / "dataset_info.json").exists():
@@ -528,17 +556,25 @@ async def upload_cohort(sid: str, cohort: list[dict]):
 # ── SSE streaming endpoints ──────────────────────────────────────────────
 
 @app.get("/api/evaluate/stream/{sid}")
-async def evaluate_stream(sid: str, parallel: int = 5, bias_calibration: bool = False,
-                          api_key: str = "", base_url: str = "", model: str = ""):
+async def evaluate_stream(sid: str, request: Request, parallel: int = 5,
+                          bias_calibration: bool = False):
     """Run evaluation with Server-Sent Events for real-time progress."""
+    _check_rate_limit(request.client.host)
     if sid not in sessions:
         raise HTTPException(404, "Session not found")
     session = sessions[sid]
     if not session["cohort"]:
         raise HTTPException(400, "No cohort — generate or upload one first")
+    # Cap parallel to prevent abuse
+    parallel = min(parallel, 10)
+
+    # Capture LLM config from request headers before entering async generator
+    _api_key = request.state.api_key
+    _base_url = request.state.base_url
+    _model = request.state.model
 
     async def event_generator():
-        client, mdl = _llm_from_params(api_key, base_url, model)
+        client, mdl = _llm_from_params(_api_key, _base_url, _model)
         cohort = session["cohort"]
         entity_text = session["entity_text"]
         total = len(cohort)
@@ -630,9 +666,9 @@ async def prepare_counterfactual(sid: str, req: CounterfactualRequest):
 
 
 @app.get("/api/counterfactual/stream/{sid}")
-async def counterfactual_stream(sid: str, ticket: str,
-                                api_key: str = "", base_url: str = "", model: str = ""):
+async def counterfactual_stream(sid: str, ticket: str, request: Request):
     """Run counterfactual probes with SSE progress."""
+    _check_rate_limit(request.client.host)
     if sid not in sessions:
         raise HTTPException(404, "Session not found")
     session = sessions[sid]
@@ -651,8 +687,13 @@ async def counterfactual_stream(sid: str, ticket: str,
     max_score = req.max_score
     parallel = req.parallel
 
+    _api_key = request.state.api_key
+    _base_url = request.state.base_url
+    _model = request.state.model
+    parallel = min(req.parallel, 10)
+
     async def event_generator():
-        client, mdl = _llm_from_params(api_key, base_url, model)
+        client, mdl = _llm_from_params(_api_key, _base_url, _model)
         cohort = session["cohort"]
         eval_results = session["eval_results"]
         cohort_map = {f"{p.get('name','')}_{p.get('user_id','')}": p for p in cohort}
@@ -742,11 +783,12 @@ async def counterfactual_stream(sid: str, ticket: str,
 
 @app.get("/api/bias-audit/stream/{sid}")
 async def bias_audit_stream(
-    sid: str, probes: str = "framing,authority,order",
-    sample: int = 10, parallel: int = 5,
-    api_key: str = "", base_url: str = "", model: str = ""
+    sid: str, request: Request, probes: str = "framing,authority,order",
+    sample: int = 10, parallel: int = 5
 ):
     """Run bias audit probes with SSE progress."""
+    _check_rate_limit(request.client.host)
+    parallel = min(parallel, 10)
     if sid not in sessions:
         raise HTTPException(404, "Session not found")
     session = sessions[sid]
@@ -757,7 +799,10 @@ async def bias_audit_stream(
 
     async def event_generator():
         import random
-        client, mdl = _llm_from_params(api_key, base_url, model)
+        _api_key = request.state.api_key
+        _base_url = request.state.base_url
+        _model = request.state.model
+        client, mdl = _llm_from_params(_api_key, _base_url, _model)
         cohort = session["cohort"]
         entity_text = session["entity_text"]
 
@@ -880,4 +925,4 @@ if __name__ == "__main__":
     host = "0.0.0.0" if IS_SPACES else "127.0.0.1"
     print(f"\n  SGO Web Interface")
     print(f"  http://{host}:{port}\n")
-    uvicorn.run(app, host=host, port=port)
+    uvicorn.run(app, host=host, port=port, access_log=False)

web/static/index.html

@@ -317,7 +317,7 @@
       <div class="step-num" style="border-color:var(--yellow);color:var(--yellow)">!</div>
       <div class="step-title">Connect your LLM</div>
     </div>
-    <p class="step-desc">SGO works with any OpenAI-compatible API. Your key is used only for this session and is never stored, logged, or sent anywhere except directly to your chosen API endpoint.</p>
+    <p class="step-desc">SGO works with any OpenAI-compatible API. Your key stays in your browser and is sent to the server only via encrypted headers — never logged, stored, or visible in URLs.</p>
     <div class="field">
       <label>API key</label>
       <input type="password" id="apiKeyInput" placeholder="sk-...">
@@ -600,20 +600,17 @@ let llmBaseUrl = '';
 let llmModel = '';
 
 function llmHeaders() {
-  return {'Content-Type': 'application/json', 'X-LLM-Key': llmApiKey, 'X-LLM-Base': llmBaseUrl, 'X-LLM-Model': llmModel};
-}
-
-function llmQueryParams() {
-  const p = new URLSearchParams();
-  if (llmApiKey) p.set('api_key', llmApiKey);
-  if (llmBaseUrl) p.set('base_url', llmBaseUrl);
-  if (llmModel) p.set('model', llmModel);
-  return p;
+  // Send credentials via Authorization header (never in URL/query params)
+  const h = {'Content-Type': 'application/json'};
+  if (llmApiKey) {
+    h['Authorization'] = `Bearer ${llmApiKey}|${llmBaseUrl}|${llmModel}`;
+  }
+  return h;
 }
 
 function apiUrl(path) {
-  const q = llmQueryParams().toString();
-  return q ? `${path}?${q}` : path;
+  // No credentials in URLs — they get logged
+  return path;
 }
 
 // XSS sanitization helper
@@ -699,7 +696,7 @@ async function setupNemotron() {
   try {
     const resp = await fetch('/api/nemotron/setup', {
       method: 'POST',
-      headers: {'Content-Type': 'application/json'},
+      headers: llmHeaders(),
       body: JSON.stringify({path, dataset}),
     });
     clearInterval(progressInterval);
@@ -776,7 +773,7 @@ async function inferSpec() {
   try {
     const resp = await fetch(apiUrl('/api/infer-spec'), {
       method: 'POST',
-      headers: {'Content-Type': 'application/json'},
+      headers: llmHeaders(),
       body: JSON.stringify({entity_text: text}),
     });
     const data = await resp.json();
@@ -820,7 +817,7 @@ async function runFullPipeline() {
     document.getElementById('pipelineProgressText').textContent = 'Setting up...';
     const sessResp = await fetch('/api/session', {
       method: 'POST',
-      headers: {'Content-Type': 'application/json'},
+      headers: llmHeaders(),
       body: JSON.stringify({entity_text: text}),
     });
     const sessData = await sessResp.json();
@@ -834,7 +831,7 @@ async function runFullPipeline() {
 
     const segResp = await fetch(apiUrl('/api/suggest-segments'), {
       method: 'POST',
-      headers: {'Content-Type': 'application/json'},
+      headers: llmHeaders(),
       body: JSON.stringify({
         entity_text: text,
         audience_context: audienceCtx || `People who would evaluate: ${text.substring(0, 200)}`,
@@ -859,7 +856,7 @@ async function runFullPipeline() {
     const desc = audienceCtx || `People evaluating: ${text.substring(0, 200)}`;
     const cohortResp = await fetch(apiUrl('/api/cohort/generate'), {
       method: 'POST',
-      headers: {'Content-Type': 'application/json'},
+      headers: llmHeaders(),
       body: JSON.stringify({description: desc, audience_context: audienceCtx, segments, parallel: 3}),
     });
     const cohortData = await cohortResp.json();
@@ -867,7 +864,7 @@ async function runFullPipeline() {
     // Upload cohort to our session
     await fetch(`/api/cohort/upload/${sessionId}`, {
       method: 'POST',
-      headers: {'Content-Type': 'application/json'},
+      headers: llmHeaders(),
       body: JSON.stringify(cohortData.cohort),
     });
 
@@ -894,7 +891,6 @@ async function runFullPipeline() {
 
     await new Promise((resolve, reject) => {
       const params = new URLSearchParams({parallel: 5, bias_calibration: biasCal});
-      llmQueryParams().forEach((v, k) => params.set(k, v));
       const es = new EventSource(`/api/evaluate/stream/${sessionId}?${params}`);
 
       es.addEventListener('start', (e) => {
@@ -989,7 +985,7 @@ async function runDirections() {
     document.getElementById('cfProgressText').textContent = 'Proposing changes to test...';
     const suggestResp = await fetch(apiUrl('/api/suggest-changes'), {
       method: 'POST',
-      headers: {'Content-Type': 'application/json'},
+      headers: llmHeaders(),
       body: JSON.stringify({entity_text: entityText, goal, concerns}),
     });
     const suggestData = await suggestResp.json();
@@ -1007,7 +1003,7 @@ async function runDirections() {
     // POST config first, get a ticket, then SSE with just the ticket
     const prepResp = await fetch(`/api/counterfactual/prepare/${sessionId}`, {
       method: 'POST',
-      headers: {'Content-Type': 'application/json'},
+      headers: llmHeaders(),
       body: JSON.stringify({
         changes: suggestedChanges,
         goal: goal,
@@ -1019,9 +1015,7 @@ async function runDirections() {
     const {ticket} = await prepResp.json();
 
     await new Promise((resolve, reject) => {
-      const cfParams = new URLSearchParams({ticket});
-      llmQueryParams().forEach((v, k) => cfParams.set(k, v));
-      const es = new EventSource(`/api/counterfactual/stream/${sessionId}?${cfParams}`);
+      const es = new EventSource(`/api/counterfactual/stream/${sessionId}?ticket=${ticket}`);
 
       es.addEventListener('start', (e) => {
         const d = JSON.parse(e.data);