🔒 Security Best Practices

Account Security

Use a Strong, Unique Password

Your Vigthoria account gives access to powerful AI tools. Protect it with a strong password that you don't use anywhere else.

Enable Two-Factor Authentication (2FA)

2FA adds a crucial extra layer of security. Even if your password is compromised, attackers can't access your account without the second factor.

To enable 2FA:

1. Go to Account Settings → Security
2. Click Enable Two-Factor Authentication
3. Scan the QR code with your authenticator app
4. Save your backup codes in a secure location

Monitor Account Activity

Regularly check your account for suspicious activity:

• Review login history in Account Settings → Security → Login History
• Check for unrecognized devices or locations
• Set up email alerts for new device logins

API Key Management

API keys are like passwords for your applications. Treat them with the same level of care.

Security Severity Levels

Never Commit Keys to Version Control

// ❌ NEVER hardcode API keys in your code
const apiKey = "vg-live-sk-abc123def456...";

// ✅ Use environment variables
const apiKey = process.env.VIGTHORIA_API_KEY;

// In your .env file (add .env to .gitignore!)
VIGTHORIA_API_KEY=vg-live-sk-abc123def456...

Set Up .gitignore Properly

# Environment files
.env
.env.local
.env.production
.env.*.local

# API keys and secrets
*.pem
*.key
secrets.json
config/secrets.yml

Use Different Keys for Different Environments

• Development: Use test/sandbox keys with limited permissions
• Staging: Use separate keys that can be rotated frequently
• Production: Use live keys with strict access controls

Rotate Keys Regularly

Even if you haven't had a security incident, rotating keys periodically limits the damage if a key is ever compromised without your knowledge.

• Rotate production keys every 90 days
• Rotate immediately if you suspect a leak
• Keep track of where each key is used before rotating

If a Key is Exposed

1. Revoke immediately — Go to Account Settings → API Keys → Revoke
2. Generate a new key
3. Update all applications using the old key
4. Review usage logs for unauthorized access
5. Investigate the leak to prevent recurrence

Code Security with AI

When using AI-generated code, you're responsible for its security. Here's how to stay safe.

Review All AI-Generated Code

AI can generate insecure code patterns. Always review for:

• SQL Injection: Ensure queries use parameterized statements
• XSS Vulnerabilities: Check that user input is properly escaped
• Authentication Flaws: Verify auth logic is correct
• Hardcoded Secrets: Remove any placeholder credentials

Be Careful What You Share with AI

Use Placeholder Values

// When sharing code with AI, replace real values:
const config = {
    apiKey: "YOUR_API_KEY_HERE",  // ✅ Placeholder
    dbHost: "db.example.com",      // ✅ Fake host
    adminEmail: "admin@example.com" // ✅ Example domain
};

Data Privacy

Understanding Data Handling

Vigthoria takes data privacy seriously:

• Your prompts and code are processed to provide responses
• We don't use your data to train models without consent
• Enterprise plans offer additional data isolation options
• You can request data deletion at any time

For Organizations

If you're using Vigthoria for business:

• Review our Privacy Policy and Terms of Service
• Consider Enterprise plans for SOC 2 compliance and data residency
• Set clear guidelines for what employees can share with AI tools
• Use workspace administration to control team access

GDPR Compliance

For EU users, Vigthoria supports GDPR requirements:

• Right to Access: Download your data from Account Settings
• Right to Deletion: Request account deletion
• Data Portability: Export your projects and history

Security Checklist