Security and Operations

Commercial API platforms must protect secrets, money, and customer trust. This page describes the minimum operating model for Open4X.

Secret Management

Current requirements:

• API keys are shown once.
• API key lookup uses hashes.
• Third-party provider keys are encrypted.
• Secrets are not written to source code, logs, or D1 as plaintext.

Provider and bot credentials use:

CONFIG_ENCRYPTION_KEY

Recommended properties:

• At least 32 random bytes.
• Stored as a Cloudflare secret.
• Never committed to git.
• Supports future key rotation with versioned encrypted values such as enc:v1:....

Logging Policy

Log by default:

• request_id
• user_id
• service_id
• alias
• provider
• model
• token usage
• status
• latency
• final cost
• error code

Do not log by default:

• API keys
• Provider keys
• Bot tokens
• Authorization headers
• Refresh tokens
• Full prompts or model responses
• Private webhook URLs

Prompt and response retention should be an explicit customer setting with a retention window.

Account Erasure

The Console exposes GET /console/account/deletion-preview and POST /console/account/deletion. Erasure requires personal context, the exact confirmation phrase DELETE MY ACCOUNT, the account email, and the current password when the account has one. Team owners must transfer ownership first, and accounts with pending refunds are temporarily blocked.

The deletion flow revokes API keys, sessions, service configuration, connected credentials, and operational data. Financial transactions are retained for accounting and disputes. User-owned R2 files are tracked in an erasure request and removed by scheduled retry; a storage failure does not restore account access or expose the original credentials.

Billing Safety

Paid services should:

• Check balance before execution.
• Write charges to transactions.
• Write refunds as separate transactions.
• Tie usage logs to request or order IDs.
• Use idempotent refund handling.
• Process stale or pending states with scheduled jobs.

High-risk scenarios:

Scenario	Control
AI stream disconnects	Use upstream usage when available; otherwise settle from the reserved estimate.
Provider timeout	Refund if no value was delivered.
TRON provider does not fulfill	Expire order and refund.
Duplicate refund retry	Use request/order IDs for idempotency.
Price changes	Store effective pricing rules for future auditability.

URL and SSRF Protection

External URLs such as webhook targets and AI provider base_url must be:

• HTTPS.
• Not localhost.
• Not loopback.
• Not private IPv4 ranges.
• Not link-local metadata endpoints.
• Not private IPv6 ranges.

CORS

Production console origin:

https://console.open4x.com

Do not allow arbitrary browser origins for console routes.

Monitoring

Monitor at least:

• Worker error rate.
• P95/P99 latency.
• D1 query failures.
• Billing transaction failures.
• Pending refunds.
• AI provider 401/403/429/5xx.
• TRON lease timeouts.
• Rate-limit hits.
• Pages availability.

Suggested alert thresholds:

Alert	Threshold
API 5xx	More than 1 percent for 5 minutes.
AI provider failures	More than 5 percent for 5 minutes.
Pending refunds	More than 10.
D1 write failures	Any repeated write failure.
Login failure spike	More than 100 in 10 minutes.

Legal Documents

Before broad commercial launch, publish:

• Terms of service.
• Privacy policy.
• Acceptable use policy.
• Refund policy.
• Data processing description.
• Third-party provider disclosure.

AI-specific terms should explain BYOK responsibilities, provider data handling, prohibited uses, and whether prompt/response retention is enabled.