Lectures

We break down how to design access rights safely in a ChatGPT‑App: why an LLM is a separate attack surface, how to avoid Confused Deputy, how to decompose access into scopes (for example, orders:write), how to restrict the model’s access by tools ( per‑tool permissions), and where to require human‑in‑the‑loop. We’ll also discuss network segmentation (gateway/edge, private network, egress allowlist) and multi‑tenant isolation via tenantId from a verified token.

In this lecture we unpack a systematic approach to secrets and sensitive data in ChatGPT Apps: where keys should live ( KMS, Secrets Manager, env‑vars), why secrets don’t belong in the system‑prompt and _meta, how a secret’s lifecycle works (creation → storage → runtime injection → rotation), and how to organize PII‑scrub (mask/remove/pseudonymize) for logs, traces, and APM (e.g., via pino and redact rules). Separately — secret scanning, actions after a leak, and common mistakes (e.g., NEXT_PUBLIC_ secrets and logging Authorization).

We examine why, in LLM applications, you can’t trust user input, model‑generated tool arguments, webhooks, or even your own “native” database. We learn to build a contract via schemas ( Zod and JSON Schema), perform normalization and coercion (for example, z.coerce.number()), forbid extra fields with .strict(), and close classic injections: SQL, XSS, and prompt injection.

Let’s break down how to reliably receive webhooks in ChatGPT Apps/Next.js: how inbound webhooks differ from regular API calls, why it’s important to read the raw body, how to verify an HMAC signature (and the timestamp), how to respond quickly to avoid retries, and how to build idempotent processing via deduplication and transactions. We’ll finish with the architectural wiring of webhooks with MCP tools and a list of common mistakes.

In this lecture we examine how to build a security and data lifecycle perimeter in a ChatGPT application (App): separate audit logs (structure actor/ action/ resource/ outcome), a data retention policy (TTL for different data classes), the “deletion on request” technique (including anonymization and linkage to backups), as well as resilience basics via RTO/ RPO, PITR, and regular restore drills.