The llama_index repository handles sensitive workflows including data ingestion, external model integrations, database interactions, and tool executions. Developers must assume that user inputs, external documents, and remote tool outputs are untrusted and potentially malicious. Security mechanisms such as authorization checks, prompt input validation, secure credential management, and TLS transport encryption must be explicitly enforced, failing closed when configuration is incomplete.
Essential implementation rules
Enforce Ownership and Authorization Checks on Storage
Always verify that the authenticated user or API key has explicit permissions to access a specific collection, index object, or chat storage entry before invoking loading methods or constructing storage keys.
Use Scoped OAuth and Token-Based Credentials
Authenticate cloud storage, vector stores, and model connections using scoped OAuth service accounts, managed identities, or token credentials like DefaultAzureCredential instead of static keys.
Validate and Sanitize Inputs and Outputs
Invoke input scanners before query processing and inspect model responses using output scanners or server-side guardrail identifiers to prevent untrusted content and prompt injections.
Disable Remote Code Execution on Model Loaders
Set trust_remote_code=False when configuring model initializers to prevent arbitrary code execution from untrusted model repositories.
Constrain Local File Paths to Safe Directories
Resolve local file paths using pathlib.Path.resolve() and verify that the target path remains within an authorized base directory before performing read or write operations.
Prevent SQL Injection Using Parameterized Queries and Structured Filters
Avoid manual string concatenation or f-strings for SQL queries, table names, and schema parameters. Use static queries, structured parameter bindings, and structured MetadataFilter objects.
Set Formatted to True for Prompts with Curly Braces
Explicitly set formatted=True when invoking completion methods with prompt text containing curly braces or user-controlled input to prevent unexpected Python string formatting vulnerabilities.
Enforce TLS Verification and Secure Endpoints
Maintain TLS certificate validation by explicitly setting verify=True, using secure HTTPS endpoints, and ensuring use_ssl=True is configured for all external client integrations.
Prevent Model Provider Data Exposure
Sanitize retrieved document nodes using postprocessors to strip personally identifiable information before transmitting context to external model providers, or use in-database embedding models.
Enforce Size Limits on User Input
Implement explicit input size checks and restrict raw text length before invocation to mitigate potential high computational load or denial of service.
Enable Production Security Features on Vector Stores
Enable authentication and SSL/TLS transport encryption on production database and vector store instances such as Elasticsearch rather than disabling them.
Configure Cloud Mode and Secure Token Storage
Set is_cloud=True when initializing tool specifications in shared or serverless environments to prevent persisting sensitive OAuth tokens to unmanaged local JSON files, and provide secure persistent token storage implementations.
Avoid Hardcoding API Keys and Environment Mutation
Do not embed secret credentials directly into source code. Fetch sensitive values dynamically from environment variables and pass session-specific API keys directly to client constructors.
Isolate Tenant Sessions Using Unique Identifiers
Specify unique session identifiers and thread IDs when instantiating chat memory or executing tools to prevent cross-tenant state pollution and data leakage.
llama-index: All Security Cards
Approximately 3,618 tokens
On this card
Category: access control
Enforce Ownership and Authorization Checks on Document and Chat Storage
Use when
When building retrieval-augmented generation apps or chat storage workflows that load indexes, vectors, or chat histories based on user-supplied parameters.
Secure rules
Rule 1: Validate user ownership and permissions before loading document indexes or chat storage entries.
Always verify that the authenticated user or API key has explicit permissions to access a specific collection or index object before invoking loading methods. Similarly, map and validate that session IDs belong to the current user before constructing storage keys for SQLAlchemyChatStore operations.
Configure cloud-native and OAuth token-based authentication for service integrations
Use when
Integrating LlamaIndex with cloud services, vector stores, and readers where identity and credentials must be established via tokens, service accounts, or managed identities.
Secure rules
Rule 1: Authenticate cloud storage and retrieval services using scoped OAuth service accounts or managed identities instead of static keys.
When configuring integrations like Google Semantic Retrieval, prefer initializing set_google_config using service account credentials with strictly required scopes rather than relying on default API key sharing.
Rule 2: Use token-based authentication credentials for database and cloud model connections.
When connecting to cloud databases or model deployments, use token credentials such as DefaultAzureCredential or cloud-native instance and resource principals to avoid hardcoding static secrets.
Validate and Scan Inputs and Outputs in Custom Query Pipelines
Use when
Integrating guardrails, scanners, or server-side safety filters to validate user prompts and inspect LLM outputs when processing queries in multimodal RAG applications.
Secure rules
Rule 1: Validate and sanitize user prompts using input scanners before query processing and inspect responses using output scanners prior to final output presentation.
Invoke input and output guardrails within custom query pipelines to prevent untrusted content, prompt injections, or unsafe model outputs from compromising system reliability or end users. Ensure validation happens before query processing and check model responses before returning context-aware data.
def execute_guarded_query(query_str, query_engine, input_scanner, output_scanner): sanitized_prompt, is_valid, _ = input_scanner.scan(query_str) if not is_valid: raise ValueError("Query rejected by input guardrail") response = query_engine.query(sanitized_prompt) sanitized_response, is_output_valid, _ = output_scanner.scan(str(response)) if not is_output_valid: raise ValueError("Response rejected by output guardrail") return sanitized_response
Rule 2: Configure server-side guardrail identifiers and versions when instantiating model integration clients.
Utilize server-side safety filters, prompt injection preventions, and content moderation policies by setting guardrail_identifier and guardrail_version parameters directly when instantiating model clients such as BedrockConverse.
Disable Remote Code Execution When Loading Untrusted Models
Use when
Configuring model loaders and initializers where custom scripts or remote execution mechanisms might be enabled.
Secure rules
Rule 1: Set trust_remote_code to False to prevent loading arbitrary code from model repositories.
When configuring model parameters for model initializers like GaudiLLM, ensure trust_remote_code is set to False unless loading from a thoroughly vetted repository. Enabling remote code execution allows custom scripts hosted on repository hubs to run arbitrary code on the host execution environment.
Validate Local Target Paths and Constrain File Access
Use when
When accepting local file paths or destination paths from user input or remote tools that interact with the local filesystem, code interpreter downloads, or document parsing blocks.
Secure rules
Rule 1: Resolve and constrain local file paths to a designated safe directory before performing read or write operations.
Always resolve paths using pathlib.Path.resolve() and verify that the target path remains within an authorized base directory to prevent path traversal, arbitrary file reads, and file overwrite vulnerabilities.
from pathlib import Pathfrom llama_index.core.base.llms.types import ChatMessage, DocumentBlock, MessageRole, TextBlockdef create_safe_doc_message(user_supplied_path: str, allowed_dir: Path) -> ChatMessage: target_path = Path(user_supplied_path).resolve() if not target_path.is_relative_to(allowed_dir.resolve()): raise ValueError("Unauthorized file path access attempt.") return ChatMessage( role=MessageRole.USER, blocks=[ DocumentBlock(path=target_path), TextBlock(text="Please analyze this document."), ] )
Category: injection
Prevent SQL Injection in Database Readers and Chat Stores
Use when
Building database readers, executing queries, or configuring chat stores with dynamic database parameters.
Secure rules
Rule 1: Avoid manual string concatenation or f-strings when constructing SQL queries and schema names.
Concatenating untrusted user inputs directly into query strings or schema parameters allows attackers to execute arbitrary SQL commands. Always use static queries, structured parameter bindings, or strict allowlists for table names and database identifiers.
from llama_index.core.storage.chat_store.sql import SQLAlchemyChatStorechat_store = SQLAlchemyChatStore( table_name="chat_history", async_database_uri="postgresql+asyncpg://user:pass@localhost/db", db_schema="app_chat_schema",)
Sanitize Dynamic Identifiers and Metadata Filters in Vector Stores
Use when
Configuring vector store metadata filters, table names, or search configurations in SQL-backed vector stores.
Secure rules
Rule 1: Use structured metadata filters and validate dynamic identifiers against strict allowlists.
Libraries that interpolate metadata keys or search configurations directly into SQL queries require strict sanitization of those keys. Pass structured MetadataFilter objects and validate filter keys and search configurations against a strict allowlist to prevent SQL injection.
Prevent unexpected string formatting vulnerabilities by setting formatted to true
Use when
Passing prompt templates or completion strings containing literal curly braces or untrusted user input to LLM completion methods.
Secure rules
Rule 1: Set formatted to true when invoking completion methods with prompt text containing curly braces or user-controlled input.
By default, prompt strings are formatted using string formatting via prompt.format(**kwargs). Untrusted input or templates containing unescaped braces can cause parsing errors or improper string manipulation. Explicitly set formatted=True when passing such prompts to prevent unexpected Python string formatting.
Enforce TLS Certificate Verification and Secure Endpoints for Network Connections
Use when
Configuring LLMs, vector stores, and external data connectors that establish outbound network connections over HTTPS or TLS.
Secure rules
Rule 1: Enable TLS certificate verification and secure transport for all external client integrations.
Always maintain TLS certificate validation by explicitly setting verify=True or providing a valid CA bundle file path, and ensure use_ssl=True is configured where supported. Never disable SSL or verification in production to prevent man-in-the-middle attacks.
Rule 2: Validate custom base URLs and restrict endpoints to trusted HTTPS destinations.
Ensure custom base URLs, API endpoints, and server configurations use secure HTTPS transport and originate strictly from trusted static configurations rather than unvalidated user input to prevent credential leakage.
from llama_index.llms.sambanovasystems import SambaNovaCloudllm = SambaNovaCloud( sambanova_url="https://api.sambanova.ai/v1/chat/completions")
Prevent Model Provider Data Exposure via PII Stripping and Local Processing
Use when
Developing applications that ingest private documents or user inputs and interact with external LLMs or third-party model providers.
Secure rules
Rule 1: Sanitize retrieved document nodes using postprocessors to strip personally identifiable information before transmitting context to external model providers.
Use NERPIINodePostprocessor or PIINodePostprocessor from llama_index.core.postprocessor to process retrieved nodes and remove PII before sending context to LLMs. Ensure service_context is configured with a locally hosted or trusted LLM during entity extraction if required.
from llama_index.core.postprocessor import NERPIINodePostprocessorpii_postprocessor = NERPIINodePostprocessor()sanitized_nodes = pii_postprocessor.postprocess_nodes(nodes)
Rule 2: Use in-database embedding models to process sensitive enterprise data and prevent external data exposure.
When processing sensitive enterprise data with Oracle AI Vector Search, use in-database ONNX models via OracleEmbeddings.load_onnx_model instead of external third-party providers like HuggingFace or OCI to keep text data within the internal database boundary.
from llama_index.embeddings.oracleai import OracleEmbeddingsOracleEmbeddings.load_onnx_model( conn=conn, dir="DEMO_PY_DIR", onnx_file="tinybert.onnx", model_name="demo_model")
Category: resource exhaustion
Enforce Size Limits on User Input Before Processing
Use when
Handling raw user-supplied strings or inputs before submitting them to ingestion pipelines or query components.
Secure rules
Rule 1: Validate payload sizes and string lengths before calling LlamaIndex query or ingestion components.
Implement explicit input size checks in hosting applications to restrict raw text length before invocation, mitigating potential high computational load or Denial of Service.
MAX_INPUT_LENGTH = 4096def process_user_text(raw_text: str, query_engine): if len(raw_text) > MAX_INPUT_LENGTH: raise ValueError(f"Input size exceeds maximum threshold of {MAX_INPUT_LENGTH} characters") return query_engine.query(raw_text)
Category: runtime environment hardening
Enable production security features when deploying Elasticsearch vector stores
Use when
Configuring Elasticsearch vector store backends in production environments for LlamaIndex applications.
Secure rules
Rule 1: Enable authentication and SSL/TLS transport encryption on production Elasticsearch vector store instances.
When instantiating ElasticsearchStore, ensure that security features and TLS are enabled rather than disabled. Pass proper credentials and secure endpoints such as es_user, es_password, and an es_url utilizing https to prevent unauthenticated access or sniffing.
Configure Cloud Mode and Persistent Storage for OAuth Tokens
Use when
Instantiating cloud tools and readers that acquire and store OAuth access and refresh tokens.
Secure rules
Rule 1: Enable cloud configuration parameters to prevent persisting OAuth tokens to local disk.
When running in shared, serverless, or cloud container environments, explicitly set is_cloud=True when initializing tool specifications or readers to prevent sensitive user tokens from being written to unmanaged local JSON files.
from llama_index.tools.google import GoogleCalendarToolSpectool_spec = GoogleCalendarToolSpec( service_account_key=service_account_info_dict, is_cloud=True)
Rule 2: Provide secure persistent token storage for client OAuth authentication.
Avoid relying on default in-memory token storage that loses credentials or increases exposure in process dumps. Provide a secure, persistent implementation when configuring clients requiring OAuth token management.
Prevent Hardcoded API Keys and Credentials in Source Files
Use when
Configuring LLMs, vector stores, readers, tools, and data connectors with third-party service credentials or database passwords.
Secure rules
Rule 1: Avoid hardcoding API keys, passwords, and tokens in source code or notebooks.
Do not embed secret credentials or plaintext keys directly into Python scripts, configuration parameters, or Jupyter notebooks. Always fetch sensitive values dynamically from environment variables or secure secret managers.
import osfrom llama_index.llms.openai import OpenAIopenai_api_key = os.getenv("OPENAI_API_KEY")if not openai_api_key: raise ValueError("OPENAI_API_KEY environment variable is missing")llm = OpenAI(api_key=openai_api_key)
Rule 2: Pass session-specific API keys directly to client constructors instead of mutating global environment state.
When handling user-provided credentials in web or multi-tenant applications, pass the API key directly to the provider client constructor rather than writing it to global process variables via os.environ to prevent credential leaks across threads or sessions.
Use Unique Session Identifiers for Tenant Isolation
Use when
Developing multi-tenant applications using LlamaIndex chat memory or tool specifications where distinct user sessions must be isolated.
Secure rules
Rule 1: Specify unique session identifiers when instantiating chat memory or executing tools to prevent cross-tenant state pollution and data leakage.
Always pass a fresh UUID or securely generated user-session-bound identifier when calling Memory.from_defaults() or when providing thread_id parameters to tool specifications. Relying on default or hardcoded session identifiers causes chat history and session context to be shared across distinct users.
Enforce Ownership and Authorization Checks on Document and Chat Storage
Approximately 192 tokens
Use when
When building retrieval-augmented generation apps or chat storage workflows that load indexes, vectors, or chat histories based on user-supplied parameters.
Secure rules
Rule 1: Validate user ownership and permissions before loading document indexes or chat storage entries.
Always verify that the authenticated user or API key has explicit permissions to access a specific collection or index object before invoking loading methods. Similarly, map and validate that session IDs belong to the current user before constructing storage keys for SQLAlchemyChatStore operations.
Configure cloud-native and OAuth token-based authentication for service integrations
Approximately 345 tokens
Use when
Integrating LlamaIndex with cloud services, vector stores, and readers where identity and credentials must be established via tokens, service accounts, or managed identities.
Secure rules
Rule 1: Authenticate cloud storage and retrieval services using scoped OAuth service accounts or managed identities instead of static keys.
When configuring integrations like Google Semantic Retrieval, prefer initializing set_google_config using service account credentials with strictly required scopes rather than relying on default API key sharing.
Rule 2: Use token-based authentication credentials for database and cloud model connections.
When connecting to cloud databases or model deployments, use token credentials such as DefaultAzureCredential or cloud-native instance and resource principals to avoid hardcoding static secrets.
Validate and Scan Inputs and Outputs in Custom Query Pipelines
Approximately 404 tokens
Use when
Integrating guardrails, scanners, or server-side safety filters to validate user prompts and inspect LLM outputs when processing queries in multimodal RAG applications.
Secure rules
Rule 1: Validate and sanitize user prompts using input scanners before query processing and inspect responses using output scanners prior to final output presentation.
Invoke input and output guardrails within custom query pipelines to prevent untrusted content, prompt injections, or unsafe model outputs from compromising system reliability or end users. Ensure validation happens before query processing and check model responses before returning context-aware data.
def execute_guarded_query(query_str, query_engine, input_scanner, output_scanner): sanitized_prompt, is_valid, _ = input_scanner.scan(query_str) if not is_valid: raise ValueError("Query rejected by input guardrail") response = query_engine.query(sanitized_prompt) sanitized_response, is_output_valid, _ = output_scanner.scan(str(response)) if not is_output_valid: raise ValueError("Response rejected by output guardrail") return sanitized_response
Rule 2: Configure server-side guardrail identifiers and versions when instantiating model integration clients.
Utilize server-side safety filters, prompt injection preventions, and content moderation policies by setting guardrail_identifier and guardrail_version parameters directly when instantiating model clients such as BedrockConverse.
Disable Remote Code Execution When Loading Untrusted Models
Approximately 249 tokens
Use when
Configuring model loaders and initializers where custom scripts or remote execution mechanisms might be enabled.
Secure rules
Rule 1: Set trust_remote_code to False to prevent loading arbitrary code from model repositories.
When configuring model parameters for model initializers like GaudiLLM, ensure trust_remote_code is set to False unless loading from a thoroughly vetted repository. Enabling remote code execution allows custom scripts hosted on repository hubs to run arbitrary code on the host execution environment.
Validate Local Target Paths and Constrain File Access
Approximately 270 tokens
Use when
When accepting local file paths or destination paths from user input or remote tools that interact with the local filesystem, code interpreter downloads, or document parsing blocks.
Secure rules
Rule 1: Resolve and constrain local file paths to a designated safe directory before performing read or write operations.
Always resolve paths using pathlib.Path.resolve() and verify that the target path remains within an authorized base directory to prevent path traversal, arbitrary file reads, and file overwrite vulnerabilities.
from pathlib import Pathfrom llama_index.core.base.llms.types import ChatMessage, DocumentBlock, MessageRole, TextBlockdef create_safe_doc_message(user_supplied_path: str, allowed_dir: Path) -> ChatMessage: target_path = Path(user_supplied_path).resolve() if not target_path.is_relative_to(allowed_dir.resolve()): raise ValueError("Unauthorized file path access attempt.") return ChatMessage( role=MessageRole.USER, blocks=[ DocumentBlock(path=target_path), TextBlock(text="Please analyze this document."), ] )
Prevent SQL Injection in Database Readers and Chat Stores
Approximately 422 tokens
Use when
Building database readers, executing queries, or configuring chat stores with dynamic database parameters.
Secure rules
Rule 1: Avoid manual string concatenation or f-strings when constructing SQL queries and schema names.
Concatenating untrusted user inputs directly into query strings or schema parameters allows attackers to execute arbitrary SQL commands. Always use static queries, structured parameter bindings, or strict allowlists for table names and database identifiers.
from llama_index.core.storage.chat_store.sql import SQLAlchemyChatStorechat_store = SQLAlchemyChatStore( table_name="chat_history", async_database_uri="postgresql+asyncpg://user:pass@localhost/db", db_schema="app_chat_schema",)
Sanitize Dynamic Identifiers and Metadata Filters in Vector Stores
Use when
Configuring vector store metadata filters, table names, or search configurations in SQL-backed vector stores.
Secure rules
Rule 1: Use structured metadata filters and validate dynamic identifiers against strict allowlists.
Libraries that interpolate metadata keys or search configurations directly into SQL queries require strict sanitization of those keys. Pass structured MetadataFilter objects and validate filter keys and search configurations against a strict allowlist to prevent SQL injection.
Prevent unexpected string formatting vulnerabilities by setting formatted to true
Approximately 191 tokens
Use when
Passing prompt templates or completion strings containing literal curly braces or untrusted user input to LLM completion methods.
Secure rules
Rule 1: Set formatted to true when invoking completion methods with prompt text containing curly braces or user-controlled input.
By default, prompt strings are formatted using string formatting via prompt.format(**kwargs). Untrusted input or templates containing unescaped braces can cause parsing errors or improper string manipulation. Explicitly set formatted=True when passing such prompts to prevent unexpected Python string formatting.
Enforce TLS Certificate Verification and Secure Endpoints for Network Connections
Approximately 646 tokens
Use when
Configuring LLMs, vector stores, and external data connectors that establish outbound network connections over HTTPS or TLS.
Secure rules
Rule 1: Enable TLS certificate verification and secure transport for all external client integrations.
Always maintain TLS certificate validation by explicitly setting verify=True or providing a valid CA bundle file path, and ensure use_ssl=True is configured where supported. Never disable SSL or verification in production to prevent man-in-the-middle attacks.
Rule 2: Validate custom base URLs and restrict endpoints to trusted HTTPS destinations.
Ensure custom base URLs, API endpoints, and server configurations use secure HTTPS transport and originate strictly from trusted static configurations rather than unvalidated user input to prevent credential leakage.
from llama_index.llms.sambanovasystems import SambaNovaCloudllm = SambaNovaCloud( sambanova_url="https://api.sambanova.ai/v1/chat/completions")
Prevent Model Provider Data Exposure via PII Stripping and Local Processing
Use when
Developing applications that ingest private documents or user inputs and interact with external LLMs or third-party model providers.
Secure rules
Rule 1: Sanitize retrieved document nodes using postprocessors to strip personally identifiable information before transmitting context to external model providers.
Use NERPIINodePostprocessor or PIINodePostprocessor from llama_index.core.postprocessor to process retrieved nodes and remove PII before sending context to LLMs. Ensure service_context is configured with a locally hosted or trusted LLM during entity extraction if required.
from llama_index.core.postprocessor import NERPIINodePostprocessorpii_postprocessor = NERPIINodePostprocessor()sanitized_nodes = pii_postprocessor.postprocess_nodes(nodes)
Rule 2: Use in-database embedding models to process sensitive enterprise data and prevent external data exposure.
When processing sensitive enterprise data with Oracle AI Vector Search, use in-database ONNX models via OracleEmbeddings.load_onnx_model instead of external third-party providers like HuggingFace or OCI to keep text data within the internal database boundary.
from llama_index.embeddings.oracleai import OracleEmbeddingsOracleEmbeddings.load_onnx_model( conn=conn, dir="DEMO_PY_DIR", onnx_file="tinybert.onnx", model_name="demo_model")
Enforce Size Limits on User Input Before Processing
Approximately 186 tokens
Use when
Handling raw user-supplied strings or inputs before submitting them to ingestion pipelines or query components.
Secure rules
Rule 1: Validate payload sizes and string lengths before calling LlamaIndex query or ingestion components.
Implement explicit input size checks in hosting applications to restrict raw text length before invocation, mitigating potential high computational load or Denial of Service.
MAX_INPUT_LENGTH = 4096def process_user_text(raw_text: str, query_engine): if len(raw_text) > MAX_INPUT_LENGTH: raise ValueError(f"Input size exceeds maximum threshold of {MAX_INPUT_LENGTH} characters") return query_engine.query(raw_text)
Enable production security features when deploying Elasticsearch vector stores
Approximately 218 tokens
Use when
Configuring Elasticsearch vector store backends in production environments for LlamaIndex applications.
Secure rules
Rule 1: Enable authentication and SSL/TLS transport encryption on production Elasticsearch vector store instances.
When instantiating ElasticsearchStore, ensure that security features and TLS are enabled rather than disabled. Pass proper credentials and secure endpoints such as es_user, es_password, and an es_url utilizing https to prevent unauthenticated access or sniffing.
Configure Cloud Mode and Persistent Storage for OAuth Tokens
Approximately 608 tokens
Use when
Instantiating cloud tools and readers that acquire and store OAuth access and refresh tokens.
Secure rules
Rule 1: Enable cloud configuration parameters to prevent persisting OAuth tokens to local disk.
When running in shared, serverless, or cloud container environments, explicitly set is_cloud=True when initializing tool specifications or readers to prevent sensitive user tokens from being written to unmanaged local JSON files.
from llama_index.tools.google import GoogleCalendarToolSpectool_spec = GoogleCalendarToolSpec( service_account_key=service_account_info_dict, is_cloud=True)
Rule 2: Provide secure persistent token storage for client OAuth authentication.
Avoid relying on default in-memory token storage that loses credentials or increases exposure in process dumps. Provide a secure, persistent implementation when configuring clients requiring OAuth token management.
Prevent Hardcoded API Keys and Credentials in Source Files
Use when
Configuring LLMs, vector stores, readers, tools, and data connectors with third-party service credentials or database passwords.
Secure rules
Rule 1: Avoid hardcoding API keys, passwords, and tokens in source code or notebooks.
Do not embed secret credentials or plaintext keys directly into Python scripts, configuration parameters, or Jupyter notebooks. Always fetch sensitive values dynamically from environment variables or secure secret managers.
import osfrom llama_index.llms.openai import OpenAIopenai_api_key = os.getenv("OPENAI_API_KEY")if not openai_api_key: raise ValueError("OPENAI_API_KEY environment variable is missing")llm = OpenAI(api_key=openai_api_key)
Rule 2: Pass session-specific API keys directly to client constructors instead of mutating global environment state.
When handling user-provided credentials in web or multi-tenant applications, pass the API key directly to the provider client constructor rather than writing it to global process variables via os.environ to prevent credential leaks across threads or sessions.
Use Unique Session Identifiers for Tenant Isolation
Approximately 221 tokens
Use when
Developing multi-tenant applications using LlamaIndex chat memory or tool specifications where distinct user sessions must be isolated.
Secure rules
Rule 1: Specify unique session identifiers when instantiating chat memory or executing tools to prevent cross-tenant state pollution and data leakage.
Always pass a fresh UUID or securely generated user-session-bound identifier when calling Memory.from_defaults() or when providing thread_id parameters to tool specifications. Relying on default or hardcoded session identifiers causes chat history and session context to be shared across distinct users.
