Security Configuration

此内容尚不支持你的语言。

Security Best Practices

1. API Key Protection

Never commit API keys to version control:

.env
*.pem
*.key

Use environment variables:

export ANTHROPIC_API_KEY=sk-ant-xxxxx

2. Webhook Verification

Always verify webhook signatures:

# Telegram
import hmac
def verify_telegram_webhook(token, data, signature):
    secret = hashlib.sha256(token.encode()).digest()
    return hmac.compare_digest(
        hmac.new(secret, data, hashlib.sha256).hexdigest(),
        signature
    )

3. Rate Limiting

Prevent abuse with rate limits:

RATE_LIMIT_ENABLED=true
RATE_LIMIT_REQUESTS=60    # requests per window
RATE_LIMIT_WINDOW=60      # window in seconds
RATE_LIMIT_BY=user        # user, ip, or channel

4. User Allowlists

Restrict access to specific users:

# Telegram
TELEGRAM_ALLOWED_USERS=123456789,987654321

# WhatsApp
WHATSAPP_ALLOWED_NUMBERS=+1234567890

# Discord
DISCORD_ALLOWED_GUILDS=123456789

5. Firewall Configuration

# Only allow necessary ports
sudo ufw allow 22/tcp      # SSH
sudo ufw allow 443/tcp     # HTTPS (webhooks)
sudo ufw enable

Encryption

Data at Rest

Encrypt sensitive data:

# Enable encryption for stored sessions
ENCRYPTION_ENABLED=true
ENCRYPTION_KEY=your_32_byte_key_here

Data in Transit

Use HTTPS for all webhooks
Claude API uses TLS by default

Audit Logging

Enable comprehensive logging:

LOG_LEVEL=INFO
LOG_FILE=/var/log/clawdbot/audit.log
LOG_FORMAT=json
LOG_INCLUDE_USER=true