DeepSeek Secure Deployment Checklist

## DeepSeek Secure Deployment Rules

### API Key Management
- Store keys in environment variables or a secrets manager (AWS Secrets Manager, HashiCorp Vault)
- Never commit keys to version control
- Use separate keys for development, staging, and production
- Rotate keys every 90 days or immediately if compromised
- Implement key usage monitoring and anomaly detection

### Input Sanitization
- Validate all user inputs before sending to DeepSeek API
- Set maximum input length (recommended: 8000 tokens for V3, 4000 for R1)
- Strip or escape HTML/script tags from user inputs
- Detect and block prompt injection attempts:
  - "Ignore previous instructions"
  - "You are now..."
  - System prompt extraction attempts
- Log flagged inputs for review (without PII)

### Output Filtering
- Scan responses for PII (email, phone, SSN patterns)
- Filter responses containing code with known vulnerability patterns
- Implement content moderation for user-facing applications
- Set up allowlists for expected output formats
- Truncate unexpectedly long responses

### Data Privacy
- Do not send PII to the API unless necessary and contractually permitted
- Implement data masking: replace real names, emails, IDs with placeholders before API calls
- Review DeepSeek's data retention policies
- Log prompts and responses only in secure, access-controlled storage
- Comply with GDPR, CCPA, and applicable regulations

### Infrastructure
- Use HTTPS for all API calls
- Implement request timeouts to prevent resource exhaustion
- Deploy behind a reverse proxy with rate limiting
- Use a WAF (Web Application Firewall) for public-facing endpoints
- Monitor for unusual traffic patterns (DDoS, credential stuffing)