Security and responsible use

Where the API key lives

The NVIDIA NIM API key is read from NVIDIA_NIM_API_KEY on the server only. It is used inside route handlers that run in the Node runtime and it is never referenced from client code.

The variable name carries no NEXT_PUBLIC_ prefix, which is what allows Next.js to inline a value into the browser bundle. Without that prefix the value cannot reach the client, and no API response ever echoes it back.

• Set it in the Vercel project settings under Environment Variables
• Mark it for the environments you intend to use it in
• Never commit it, and never rename it to start with NEXT_PUBLIC_
• Rotate it in the NVIDIA console if you suspect exposure

Redaction

Every payload bound for the model passes through the redaction module twice, once in the browser and once again on the server. The server pass exists because a server should never assume the client behaved.

Redaction masks values rather than removing keys, so the model can still reason about where a credential travels without ever seeing one.

What OakParse deliberately does not do

• It does not brute force paths or enumerate endpoints by guessing
• It does not attempt to bypass, weaken, or test authentication
• It does not fuzz inputs or probe for injection
• It does not send any request without an explicit action from you
• It does not label anything a vulnerability. Observations are reported as observations with the evidence that produced them.

Outbound request guards

The URL discovery and playground routes both fetch arbitrary addresses by design, which is exactly the shape that server side request forgery abuses. Both routes pass every target through a guard first.

• Only http and https schemes are accepted
• Cloud metadata endpoints are always blocked
• Private and loopback address ranges are blocked when OAKPARSE_BLOCK_PRIVATE_NETWORK is enabled, which is the default in production
• Requests carry a timeout and a response size ceiling
• Hop by hop and runtime owned headers cannot be forged by the caller

Destructive requests

POST, PUT, PATCH, and DELETE requests in the playground require a second confirmation that names the method and the host before anything is sent. This is not a generic dialog. It states what will happen and where.

Reporting a vulnerability

If you find a security issue in OakParse, please report it privately through the security advisory form on the project repository rather than opening a public issue. Include the version or commit, reproduction steps, and what an attacker gains.

Reports are acknowledged as quickly as the maintainers can manage. Please give a reasonable window for a fix before publishing.

Self hosting for full privacy

Pointing NVIDIA_NIM_BASE_URL at a NIM container you run yourself keeps model traffic inside your own infrastructure. Combined with the browser side analysis that already applies to HAR files, that leaves no data path out of your control.