Enterprise Security

Defense in Depth

BPract Agents uses a defense-in-depth strategy where security controls are layered at every level of the stack. Input from visitors is validated and sanitized before reaching the AI. API endpoints are protected by authentication, authorization, and rate limiting. Outbound requests from actions are checked against SSRF rules. The widget uses Shadow DOM to prevent DOM-based attacks. Admin routes require authenticated sessions with role-based permissions. This multi-layered approach means that even if one control is bypassed, others catch the threat.

Key Security Controls

• Prompt injection detection scans every visitor message for known attack patterns and jailbreak attempts before sending to the LLM
• Rate limiting at IP, session, and tenant levels prevents automated abuse and denial-of-service attacks
• SSRF validation ensures webhook URLs and action endpoints cannot target internal network resources
• The esc() helper function sanitizes all dynamic content before rendering in the widget, preventing stored and reflected XSS
• Token budget enforcement tracks daily token usage per tenant and gracefully limits when the budget is exhausted
• All admin endpoints require Depends(get_current_admin) authentication with RBAC role verification
• CORS is dynamically configured per tenant domain, preventing unauthorized cross-origin access
• Security headers including Content-Security-Policy, X-Frame-Options, and Strict-Transport-Security are set on all responses

Audit History

The 67 security controls are the result of seven comprehensive audit rounds conducted throughout the platform development. Each audit round identified potential vulnerabilities and resulted in concrete fixes. The controls are documented, tested, and continuously enforced through code review policies. New features go through a security checklist before deployment to ensure no existing controls are weakened or bypassed.