Security and Access

Authentication state

Control	Current state
Email login	Enabled
Open registration	Disabled
Social login and registration	Disabled
Violation banning	Enabled
Reverse-proxy trust	Enabled for the Railway proxy path
Public Agents	Disabled
Agent sharing	Enabled through users, groups, and roles
Bauer MCP authentication	Bearer token required
Local AI authentication	Scoped backend keys required

The initial administrator is [email protected]. Additional users should receive the minimum Agent-group access needed for their work.

Secret locations

Secret class	Correct location
MongoDB, PostgreSQL, Meilisearch, S3, JWT, and encryption secrets	Railway service variables
Local AI chat and embedding keys	Scoped Railway variables and Local AI server secret configuration
Bauer MCP bearer key	Railway variables and an encrypted local automation credential
Administrator password	Windows DPAPI-encrypted credential outside Git
SSH private key	Restricted local authentication directory outside Git

Never place secret values in:

• librechat.yaml;
• Git commits;
• wiki pages;
• benchmark output;
• screenshots;
• issue or chat transcripts;
• browser JavaScript.

Railway CLI JSON variable output contains raw values. Filter to variable names or an explicit non-secret allowlist before recording diagnostics.

Agent and corpus authorization

The current controls are:

1. The Agent is private.
2. The Agent is granted only to its matching group as agent_viewer.
3. The group contains authorized users.
4. Each Agent has disjoint file associations.
5. Tools are assigned per Agent; Test Archive does not receive the Bauer structured tool.

Agent instructions are defence in depth, not authorization. A prompt telling the model not to mix companies cannot compensate for incorrect file or group permissions.

Isolation limits

The deployment shares:

• one LibreChat application;
• one MongoDB service;
• one Meilisearch service;
• one PostgreSQL/pgvector service;
• one S3 bucket and storage credential set;
• one Railway project and operational administrator boundary.

Logical Agent isolation is appropriate for the current demonstration. Use separate stacks when a customer requires independent encryption keys, backups, database administrators, data regions, incident handling, or contractual deletion evidence.

Public and private endpoints

• chat.rapiddraft.ai is the public user interface and requires login.
• LibreChat, RAG, and Bauer health endpoints expose only operational status.
• MongoDB, PostgreSQL, and Meilisearch are private Railway services.
• Bauer search and MCP routes require a bearer token.
• Local AI model routes require scoped backend credentials and must not be called directly from browser code.

Current hardening gaps

Gap	Risk	Required action before production
Overlay upgrade drift	A future upstream change may invalidate reviewed file-search assumptions	Keep immutable digests, source checksums, and acceptance tests current
Local email/password identity	Separate user lifecycle from RapidDraft	Add SSO, account linking, or a scoped gateway identity
One operational stack for multiple companies	Shared administration and backup boundary	Confirm contracts; use separate stacks where required
No tested cross-service restore	Data may not recover consistently	Automate backup and run restore drills
One local inference host	Availability and demonstration risk	Add queue protection and an approved fallback or standby
US East Railway compute	Potential customer data-residency concern	Confirm residency requirement and move production if necessary
Shared backend model credentials	Broad impact if leaked	Rotate regularly and separate UI, test, and ingestion keys

Credential rotation

Rotate a credential immediately after suspected disclosure or unnecessary output. The rotation is complete only when:

1. A new value is generated in the owning system.
2. Every authorized consumer is updated.
3. A controlled redeploy or restart loads the new value.
4. Health and functional tests pass.
5. The old value is revoked.
6. Logs and repositories are checked for accidental persistence.
7. The event is recorded without copying the secret.

RapidDraft integration security

A future RapidDraft Agent gateway must:

• keep LibreChat Remote Agent credentials server-side;
• authenticate the RapidDraft user and tenant;
• re-authorize every model_id and artifact;
• expose curated domain tools rather than the full FastAPI/OpenAPI surface;
• use idempotency keys and approval gates for mutations;
• return compact facts, stable IDs, citations, and viewer actions rather than raw CAD geometry;
• record Agent runs, tool calls, artifacts, approvals, and viewer actions in RapidDraft-owned audit contracts.

LibreChat Agent access alone must never grant access to a RapidDraft CAD model.

Open Questions

• Which identity provider will be authoritative for production LibreChat access?
• Which customer deployments require physical rather than logical isolation?
• What retention and deletion evidence must be available per customer?

Sources

• D:\02_Code\LibreChat_Setup\librechat.yaml
• Railway non-secret configuration audit captured on 2026-07-21
• D:\02_Code\LibreChat_Setup\scripts\provision-knowledge-bases.ps1
• D:\02_Code\LibreChat_Setup\services\librechat-custom\fileSearch.js
• D:\02_Code\LibreChat_Setup\services\rag-api-custom\batch_authorization.py
• D:\02_Code\00_Project_Management_n_skills\01_tracks\rapiddraft-studio\plans\260720_librechat-rapiddraft-integration\README.md