Secure RAG Kit

A production-ready RAG (Retrieval-Augmented Generation) system with built-in security guardrails for prompt injection detection and PII filtering.

Features

• Semantic Search: Vector-based document search using OpenAI embeddings and Qdrant
• Security Guardrails:
  • Input Guard: Detects prompt injection, role manipulation, jailbreak attempts
  • Output Guard: Detects and redacts PII (emails, SSNs, credit cards, API keys)
  • Rate Limiter: Protects against abuse and resource exhaustion
• Document Management: Upload, index, and search text documents
• Modern Stack: FastAPI, Next.js, PostgreSQL, Qdrant

Quick Start

Prerequisites

• Docker and Docker Compose
• Python 3.11+
• Node.js 20+

Setup

1. Clone the repository:

git clone https://github.com/musabdulai-io/secure-rag-kit.git
cd secure-rag-kit

2. Run the setup script:

./setup.sh

3. Update your environment:

# Edit .env and add your OPENAI_API_KEY
nano .env

4. Start the services:

docker compose up

5. Access the application:

• Frontend: http://localhost:3000
• Backend API: http://localhost:8000
• API Docs: http://localhost:8000/docs

Seed Sample Data

docker compose exec backend python -m scripts.seed

Test Security Guards

docker compose exec backend python -m scripts.test_security

Architecture

┌─────────────────────────────────────────────────────────────┐
│                         Frontend                             │
│                    (Next.js + MUI)                          │
└─────────────────────────┬───────────────────────────────────┘
                          │
                          ▼
┌─────────────────────────────────────────────────────────────┐
│                      API Layer                               │
│                       (FastAPI)                              │
│  ┌──────────────┐  ┌──────────────┐  ┌──────────────┐       │
│  │ Input Guard  │  │ Rate Limiter │  │ Output Guard │       │
│  └──────────────┘  └──────────────┘  └──────────────┘       │
└─────────────────────────┬───────────────────────────────────┘
                          │
          ┌───────────────┼───────────────┐
          ▼               ▼               ▼
┌─────────────────┐ ┌───────────┐ ┌─────────────────┐
│   PostgreSQL    │ │  Qdrant   │ │    Storage      │
│   (Documents)   │ │ (Vectors) │ │  (Local/GCS)    │
└─────────────────┘ └───────────┘ └─────────────────┘

Security Features

Input Guard

Detects and blocks:

• Role manipulation ("ignore previous instructions")
• Prompt extraction attempts
• Delimiter injection (```, ###)
• Jailbreak patterns
• Encoding attacks (base64)

Output Guard

Detects and redacts:

• Email addresses
• Phone numbers
• Social Security Numbers
• Credit card numbers
• API keys and tokens
• IP addresses

Rate Limiter

• Configurable requests per window
• In-memory for development
• Ready for Redis in production

API Endpoints

Method	Endpoint	Description
POST	/api/v1/rag/documents	Upload a document
GET	/api/v1/rag/documents	List all documents
GET	/api/v1/rag/documents/{id}	Get document by ID
DELETE	/api/v1/rag/documents/{id}	Delete a document
POST	/api/v1/rag/search	Search documents
GET	/health	Health check

Configuration

Environment variables (see .env.example):

Variable	Description	Default
OPENAI_API_KEY	OpenAI API key	Required
DATABASE_URL	PostgreSQL connection string	See .env.example
QDRANT_URL	Qdrant server URL	http://localhost:6333
RATE_LIMIT_REQUESTS	Max requests per window	100
RATE_LIMIT_WINDOW	Rate limit window (seconds)	60

Development

Local Development (IDE Support)

The ./setup.sh script sets up your local environment:

• Creates Python virtual environment with dependencies
• Installs Node.js dependencies
• Copies .env.example to .env

For IDE intellisense, activate the backend venv:

source backend/venv/bin/activate

Database Migrations

docker compose exec backend alembic revision --autogenerate -m "description"
docker compose exec backend alembic upgrade head

License

MIT

---

Contact

Have questions or want to discuss this project?

• Email: hello@musabdulai.com
• Book a call: Schedule a meeting
• Website: musabdulai.com