anyllm-proxy/docs/security-audit.md

Security Audit

Authentication

Proxy Auth Boundary

• The proxy validates that requests carry either x-api-key or Authorization: Bearer header
• The proxy does NOT verify the key value itself; it prevents accidental open proxying
• Client credentials are never forwarded to OpenAI
• OpenAI is always called with the server-configured OPENAI_API_KEY

Recommendation

• For production, add key verification against an allowlist
• Consider mTLS or OAuth/JWT at the proxy edge for multi-tenant deployments

Request Size Limits

• 32 MB body limit enforced via axum's DefaultBodyLimit
• Matches Anthropic's documented Messages endpoint limit
• Prevents memory exhaustion from oversized payloads

SSRF Prevention

• The proxy only makes outbound HTTP requests to OPENAI_BASE_URL (configured via env)
• No user-controlled URLs are fetched:
  • Image URLs in content are passed as text, not fetched
  • Document blocks are converted to text notes, not processed
  • No file download/upload proxying

Recommendation

• Validate OPENAI_BASE_URL is not a private/internal address at startup
• Consider URL allowlist for production

Secret Handling

• OPENAI_API_KEY is read from environment (never hardcoded)
• redact_secret() utility available for logging (shows first/last 4 chars only)
• Authorization headers are not logged
• Request bodies may contain sensitive content; RUST_LOG should be info in production

Concurrency Protection

• Tower ConcurrencyLimitLayer caps at 100 concurrent requests
• Prevents self-DOS during upstream 429 incidents
• Retry logic has exponential backoff to avoid hammering upstream

Header Filtering

• Inbound x-api-key and Authorization headers are consumed, not forwarded
• anthropic-version header is accepted but not forwarded
• Outbound requests only include Authorization: Bearer with server key
• x-request-id is generated/echoed for correlation

Streaming Security

• Bounded channel (capacity 32) prevents unbounded memory growth
• Client disconnect detected and upstream connection dropped
• No content buffering; deltas translated directly

Dependencies

• All dependencies are from crates.io (auditable)
• No unsafe code in project source
• cargo audit should be run in CI

OWASP Top 10 Relevance

Risk	Status	Notes
Injection	Mitigated	No SQL/shell; JSON parsed via serde
Broken Auth	Partial	Auth presence checked; value not verified
Sensitive Data Exposure	Mitigated	Secrets redacted in logs; env-based config
XML External Entities	N/A	JSON only
Broken Access Control	N/A	Single-purpose proxy
Security Misconfiguration	Mitigated	Sensible defaults; env-based config
XSS	N/A	API-only, no HTML
Insecure Deserialization	Mitigated	Typed serde with strict schemas
Using Components with Known Vulns	Recommendation	Run cargo audit in CI
Insufficient Logging	Mitigated	Structured tracing with request IDs