Credential separation by design
Public demos should not become a security shortcut.
SmartBiz separates the private SEO OpenAI key, visitor-supplied demo credentials and client production credentials.
Credential architecture
PRIVATEOPENAI_SEO_API_KEYSmartBiz Growth OS only
PUBLIC TESTVisitor-supplied keyPer request; no fallback to private key
CLIENTClient-owned credentialsProduction deployment
NEVERSecrets in frontend codeKeys stay server-side during proxy calls
Public test rules
- HTTPS required in production
- Credential fields use password inputs and autocomplete is disabled
- Server responses do not echo API keys
- Application logs should never include request bodies containing secrets
- Rate limits reduce public abuse
- Generic webhooks block localhost and private-network targets to reduce SSRF risk
- Finance and HR demos use sample/local data unless the visitor explicitly provides their own credentials