# Generate secure API keys
swiftclaw keys create my-agent --length 64

# Enable MFA for sensitive operations
swiftclaw security mfa enable my-agent

{
  "roles": {
    "admin": ["read", "write", "delete", "manage"],
    "developer": ["read", "write"],
    "viewer": ["read"]
  }
}

# Set automatic rotation
swiftclaw security rotation my-agent --interval 90d

# Bad
api_key = "sk-abc123..."

# Good
api_key = os.getenv("OPENAI_API_KEY")

# Best
api_key = await agent.secrets.get("api-key")

# Store secrets securely
swiftclaw secrets set my-agent api-key --value sk-...

# Prevent secret leaks
swiftclaw security scan my-agent --enable

{
  "security": {
    "enforceHttps": true,
    "hsts": {
      "enabled": true,
      "maxAge": 31536000
    }
  }
}

{
  "security": {
    "ipWhitelist": {
      "enabled": true,
      "addresses": ["203.0.113.0/24"]
    }
  }
}

{
  "security": {
    "rateLimit": {
      "enabled": true,
      "requests": 100,
      "window": "1m"
    }
  }
}

from pydantic import BaseModel, validator

class MessageInput(BaseModel):
    content: str
    user_id: str
    
    @validator('content')
    def validate_content(cls, v):
        if len(v) > 10000:
            raise ValueError('Content too long')
        return v

@agent.on_message
async def handle_message(message: MessageInput):
    # Input validated automatically
    return await agent.generate(message.content)

import bleach

def sanitize_input(text: str) -> str:
    # Remove HTML tags
    clean = bleach.clean(text, strip=True)
    
    # Remove special characters
    clean = re.sub(r'[^\w\s-]', '', clean)
    
    return clean

@agent.on_message
async def handle_message(message):
    clean_message = sanitize_input(message.content)
    return await agent.generate(clean_message)

@agent.middleware
async def content_filter(message):
    # Check for malicious content
    if contains_malicious_content(message.content):
        raise SecurityError("Malicious content detected")
    
    # Check for PII
    if contains_pii(message.content):
        message.content = redact_pii(message.content)

from cryptography.fernet import Fernet

# Generate encryption key
key = Fernet.generate_key()
cipher = Fernet(key)

# Encrypt data
encrypted = cipher.encrypt(sensitive_data.encode())

# Decrypt data
decrypted = cipher.decrypt(encrypted).decode()

{
  "dataRetention": {
    "logs": "30d",
    "memory": "90d",
    "analytics": "1y"
  }
}

def anonymize_data(data: dict) -> dict:
    # Remove PII
    data.pop('email', None)
    data.pop('phone', None)
    
    # Hash identifiers
    data['user_id'] = hash_id(data['user_id'])
    
    return data

# Grant minimal permissions
swiftclaw access grant user@example.com \
  --agent my-agent \
  --permission read

# Enable audit logging
swiftclaw audit enable my-agent

# View audit logs
swiftclaw audit logs my-agent --period 30d

# Set up alerts for unusual access
swiftclaw alerts create \
  --agent my-agent \
  --metric unusual-access \
  --action notify

# Check for vulnerabilities
npm audit

# Update dependencies
npm update

# Fix vulnerabilities
npm audit fix

# .github/workflows/security.yml
name: Security Scan
on: [push, pull_request]

jobs:
  scan:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v3
      - name: Run Snyk
        uses: snyk/actions/node@master
        env:
          SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}

{
  "dependencies": {
    "express": "4.18.2",
    "openai": "4.28.0"
  }
}

# Enable security monitoring
swiftclaw security monitor my-agent --enable

# Alert on failed authentication
swiftclaw alerts create \
  --agent my-agent \
  --metric failed-auth \
  --threshold 10 \
  --window 5m

# Alert on unusual activity
swiftclaw alerts create \
  --agent my-agent \
  --metric unusual-activity \
  --action notify

# View security events
swiftclaw logs my-agent --filter security

# Export security logs
swiftclaw logs export my-agent \
  --filter security \
  --period 30d

## Incident Response Plan

### Detection
- Monitor alerts
- Review logs daily
- Track anomalies

### Response
1. Identify incident type
2. Contain the threat
3. Investigate root cause
4. Remediate vulnerability
5. Document incident

### Recovery
- Restore from backup
- Verify system integrity
- Monitor for recurrence

{
  "security": {
    "autoRollback": {
      "enabled": true,
      "triggers": ["security-breach", "data-leak"]
    }
  }
}

# Enable automatic backups
swiftclaw backup enable my-agent --interval 24h

# Create manual backup
swiftclaw backup create my-agent

# Restore from backup
swiftclaw backup restore my-agent --backup backup-id

# Implement right to deletion
@agent.endpoint("/delete-user-data")
async def delete_user_data(user_id: str):
    await agent.memory.delete(user_id=user_id)
    await agent.logs.delete(user_id=user_id)
    return {"status": "deleted"}

# Implement data export
@agent.endpoint("/export-user-data")
async def export_user_data(user_id: str):
    data = await agent.memory.export(user_id=user_id)
    return {"data": data}

# Enable compliance logging
swiftclaw compliance enable my-agent --standard soc2

# Generate compliance report
swiftclaw compliance report my-agent --period 90d

{
  "compliance": {
    "hipaa": {
      "enabled": true,
      "encryption": "aes-256",
      "auditLogging": true,
      "accessControl": "strict"
    }
  }
}