# Store the key in a vault (e.g., Azure Key Vault, AWS Secrets Manager)
export OPENAI_API_KEY=$(az keyvault secret show \
    --vault-name MyVault \
    --name OpenAIKey \
    --query value -o tsv)

import re

def is_safe_prompt(prompt: str) -> bool:
    # Block known malicious patterns
    blacklist = [
        r'(?i)download\s+.*\.ps1',
        r'(?i)create\s+.*(scheduled|cron).*task',
        r'(?i)exfiltrate\s+.*(s3|ftp|http)'
    ]
    return not any(re.search(p, prompt) for p in blacklist)

if not is_safe_prompt(user_prompt):
    raise ValueError("Prompt rejected by policy engine")

docker run --rm -i \
    --read-only \
    --cap-drop ALL \
    -v $(pwd)/sandbox:/sandbox \
    python:3.11-slim bash -c "python - <<'PY'
import sys, subprocess, json
code = json.load(sys.stdin)['code']
exec(code)   # runs inside container, never on host
PY"

# Example using Kong Rate Limiting plugin
curl -i -X POST http://localhost:8001/services/openai-service/plugins \
    --data "name=rate-limiting" \
    --data "config.minute=1000" \
    --data "config.policy=local"

index=network sourcetype=firewall dest_ip=*.openai.com
| stats count by src_ip, dest_ip, _time
| where count > 500
| sendalert my_alert_action

import os, json, requests
from datetime import datetime, timedelta

API_URL = "https://api.openai.com/v1/chat/completions"
KEY = os.getenv("OPENAI_API_KEY")
THRESHOLD = 50               # requests per minute
WINDOW   = timedelta(minutes=1)

# Simple in‑memory counter (replace with Redis for production)
counter = {}

def log_call():
    now = datetime.utcnow()
    minute = now.replace(second=0, microsecond=0)
    counter[minute] = counter.get(minute, 0) + 1
    # Cleanup old windows
    for ts in list(counter):
        if now - ts > WINDOW:
            del counter[ts]

def is_anomalous():
    now = datetime.utcnow().replace(second=0, microsecond=0)
    return counter.get(now, 0) > THRESHOLD

def call_openai(messages):
    log_call()
    if is_anomalous():
        raise RuntimeError("API usage rate limit exceeded – possible abuse")
    resp = requests.post(
        API_URL,
        headers={"Authorization": f"Bearer {KEY}"},
        json={"model": "gpt-4o-mini", "messages": messages},
        timeout=10,
    )
    resp.raise_for_status()
    return resp.json()

# Example usage
if __name__ == "__main__":
    try:
        out = call_openai([{"role":"user","content":"Write a one‑liner PowerShell to list processes"}])
        print(json.dumps(out, indent=2))
    except Exception as e:
        print("Alert:", e)