# API Security

## Requirements

All APIs must:

- Authenticate correctly.
- Validate input.
- Return safe errors.

---

# Rate Limiting

Protect:

- Login.
- AI endpoints.
- File uploads.
- Public CV pages.

---

# API Keys

Admin-only.

Never expose:

- Provider keys.
- Secrets.
- Tokens.

---

# External APIs

Validate responses.

Do not trust third-party data.