> For the complete documentation index, see [llms.txt](https://dnotifier.gitbook.io/product-docs/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://dnotifier.gitbook.io/product-docs/operations/security.md).

# Security best practices

DNotifier handles realtime messaging, AI, and stored knowledge-base content. Follow these practices to protect credentials, user data, and your production environment.

***

## Protect your app secret

Your **secret** paired with `appId` authenticates full access to your DNotifier application.

| Do                                                         | Don't                                    |
| ---------------------------------------------------------- | ---------------------------------------- |
| Store secrets in environment variables or a secret manager | Commit secrets to git                    |
| Rotate secrets immediately after a leak                    | Log secrets in application logs          |
| Use different apps/secrets for dev and production          | Share one secret across all environments |
| Restrict dashboard access to trusted team members          | Paste secrets in support tickets or chat |

→ [Credentials & environment](/product-docs/getting-started/credentials.md)

***

## Browser and mobile clients

{% hint style="danger" %}
**Never ship your app secret in client-side bundles** that end users can download or inspect.
{% endhint %}

| Pattern                   | Description                                                                  |
| ------------------------- | ---------------------------------------------------------------------------- |
| **Backend proxy**         | Browser calls your API; server holds the secret and talks to DNotifier       |
| **Post-login connection** | User authenticates with your auth; server returns only what the client needs |
| **HTTP-only AI**          | AI and RAG run on your server with `transport: "http"`                       |

The JavaScript and Flutter Web guides describe dev-only `import.meta.env` / `--dart-define` patterns — acceptable for local development, not for public production apps.

→ [Browser platform guide](/product-docs/platform-guides/browser.md) · [Flutter platform guide](/product-docs/platform-guides/flutter.md)

***

## User ID and routing

DNotifier uses **directed messaging** — `senderId` sends to explicit `receiverId` or `receiverIds`.

* Treat `userId` as a routing key, not proof of identity by itself
* Validate on your backend that the authenticated user may act as a given `senderId`
* Do not let clients pick arbitrary `receiverId` values without authorization checks

{% hint style="info" %}
There are no broadcast topics or channel subscriptions. "Notify everyone in a room" means your app maintains the participant list and sends to each ID explicitly.
{% endhint %}

***

## Message payload safety

Incoming messages are untrusted input from other users or services.

| Risk               | Mitigation                                                 |
| ------------------ | ---------------------------------------------------------- |
| **XSS**            | Sanitize HTML before rendering chat content                |
| **Injection**      | Validate JSON shape; do not `eval` payload data            |
| **Phishing links** | Warn users or allowlist link domains in UI                 |
| **Large payloads** | Respect `messageSizeLimit`; handle chunk reassembly safely |

***

## Transport security

| Transport       | Production requirement                                  |
| --------------- | ------------------------------------------------------- |
| WebSocket       | `wss://` to `api.dnotifier.com` (default SDK endpoints) |
| HTTP auth / RPC | `https://` only                                         |
| Custom `url`    | Never use plain `ws://` or `http://` in production      |

→ [Endpoints & custom URL](/product-docs/reference/endpoints.md)

***

## AI and knowledge base

| Topic               | Guidance                                                                                    |
| ------------------- | ------------------------------------------------------------------------------------------- |
| **PII in prompts**  | Minimize personal data sent to `sendAI`; follow your privacy policy                         |
| **RAG documents**   | Index only content you are allowed to store and retrieve                                    |
| **Session history** | `fetchAIHistory` and `fetchChatHistory` return sensitive data — gate access in your app     |
| **Delete APIs**     | Use `deleteAIHistoryMessage` and `deleteChatHistoryMessage` to honor user deletion requests |

→ [AI overview](/product-docs/ai/overview.md) · [Chat history](/product-docs/chat/chat-history.md)

***

## Workflow observability

When `observability: true`, step inputs and outputs may appear in the DNotifier workflow dashboard.

* Avoid logging secrets, tokens, or raw PII in workflow step `input` / `output`
* Use `label` fields for human-readable step names, not sensitive content

→ [Workflow observability](/product-docs/workflows-and-agents/observability.md)

***

## Dependency hygiene

| Practice               | Detail                                                                                                                            |
| ---------------------- | --------------------------------------------------------------------------------------------------------------------------------- |
| Pin SDK versions       | Use semver ranges consciously in `package.json` / `pubspec.yaml`                                                                  |
| Audit dependencies     | Run `npm audit` or `dart pub outdated` regularly                                                                                  |
| Official packages only | Install from [npm](https://www.npmjs.com/package/@dnotifier-realtime/dnotifier) and [pub.dev](https://pub.dev/packages/dnotifier) |

***

## Incident response

If a secret is exposed:

1. **Rotate** the secret in [app.dnotifier.com](https://app.dnotifier.com) immediately
2. **Redeploy** all services using the old secret
3. **Review** dashboard logs for unusual AI or message activity
4. **Document** the incident and update access controls

→ [Support & links](/product-docs/appendix/support.md)

***

## Compliance checklist (summary)

| Area           | Action                                     |
| -------------- | ------------------------------------------ |
| Secrets        | Environment / vault only                   |
| Client apps    | No embedded production secrets             |
| Messages       | Validate and sanitize before display       |
| TLS            | Default production endpoints only          |
| Access control | Backend validates sender/receiver identity |
| Data deletion  | Use SDK delete APIs where required         |

***

## Related guides

* [Production checklist](/product-docs/operations/production-checklist.md)
* [Troubleshooting — auth 400](/product-docs/operations/troubleshooting.md#auth-400-authentication-failed)
* [Developer integration guide](/product-docs/platform-overview/developer-integration-guide.md)