musabdulai-io/secure-rag-kit

# Secure RAG Kit A production-ready RAG (Retrieval-Augmented Generation) system with built-in security guardrails for prompt injection detection and PII filtering. ## Features - **Semantic Search**: Vector-based document search using OpenAI embeddings and Qdrant - **Security Guardrails**: - **Input Guard**: Detects prompt injection, role manipulation, jailbreak attempts - **Output Guard**: Detects and redacts PII (emails, SSNs, credit cards, API keys) - **Rate Limiter**: Protects against abuse and resource exhaustion - **Document Management**: Upload, index, and search text documents - **Modern Stack**: FastAPI, Next.js, PostgreSQL, Qdrant ## Quick Start ### Prerequisites - Docker and Docker Compose - Python 3.11+ - Node.js 20+ ### Setup 1. Clone the repository: git clone https://github.com/musabdulai-io/secure-rag-kit.git cd secure-rag-kit 2. Run the setup script: ./setup.sh 3. Update your environment: # Edit .env and add your OPENAI_API_KEY nano .env 4. Start the services: docker compose up 5. Access the application: - Frontend: http://localhost:3000 - Backend API: http://localhost:8000 - API Docs: http://localhost:8000/docs ### Seed Sample Data docker compose exec backend python -m scripts.seed ### Test Security Guards docker compose exec backend python -m scripts.test_security ## Architecture ┌─────────────────────────────────────────────────────────────┐ │ Frontend │ │ (Next.js + MUI) │ └─────────────────────────┬───────────────────────────────────┘ │ ▼ ┌─────────────────────────────────────────────────────────────┐ │ API Layer │ │ (FastAPI) │ │ ┌──────────────┐ ┌──────────────┐ ┌──────────────┐ │ │ │ Input Guard │ │ Rate Limiter │ │ Output Guard │ │ │ └──────────────┘ └──────────────┘ └──────────────┘ │ └─────────────────────────┬───────────────────────────────────┘ │ ┌───────────────┼───────────────┐ ▼ ▼ ▼ ┌─────────────────┐ ┌───────────┐ ┌─────────────────┐ │ PostgreSQL │ │ Qdrant │ │ Storage │ │ (Documents) │ │ (Vectors) │ │ (Local/GCS) │ └─────────────────┘ └───────────┘ └─────────────────┘ ## Security Features ### Input Guard Detects and blocks: - Role manipulation ("ignore previous instructions") - Prompt extraction attempts - Delimiter injection (```, ###) - Jailbreak patterns - Encoding attacks (base64) ### Output Guard Detects and redacts: - Email addresses - Phone numbers - Social Security Numbers - Credit card numbers - API keys and tokens - IP addresses ### Rate Limiter - Configurable requests per window - In-memory for development - Ready for Redis in production ## API Endpoints | Method | Endpoint | Description | |--------|----------|-------------| | POST | `/api/v1/rag/documents` | Upload a document | | GET | `/api/v1/rag/documents` | List all documents | | GET | `/api/v1/rag/documents/{id}` | Get document by ID | | DELETE | `/api/v1/rag/documents/{id}` | Delete a document | | POST | `/api/v1/rag/search` | Search documents | | GET | `/health` | Health check | ## Configuration Environment variables (see `.env.example`): | Variable | Description | Default | |----------|-------------|---------| | `OPENAI_API_KEY` | OpenAI API key | Required | | `DATABASE_URL` | PostgreSQL connection string | See .env.example | | `QDRANT_URL` | Qdrant server URL | http://localhost:6333 | | `RATE_LIMIT_REQUESTS` | Max requests per window | 100 | | `RATE_LIMIT_WINDOW` | Rate limit window (seconds) | 60 | ## Development ### Database Migrations docker compose exec backend alembic revision --autogenerate -m "description" docker compose exec backend alembic upgrade head ## License MIT ## Contact Have questions or want to discuss this project? - **Email**: [hello@musabdulai.com](mailto:hello@musabdulai.com) - **Book a call**: [Schedule a meeting](https://calendly.com/musabdulai/ai-security-check) - **Website**: [musabdulai.com](https://musabdulai.com)