def validate_topic(topic: str) -> str:
    """Validate and sanitize research topic."""
    # Remove dangerous characters
    topic = re.sub(r'[<>"\']', '', topic)
    
    # Length limits
    if len(topic) < 3:
        raise ValueError("Topic too short")
    if len(topic) > 500:
        raise ValueError("Topic too long")
    
    return topic.strip()

# Allowed extensions
ALLOWED_EXTENSIONS = {'.pdf', '.txt', '.md'}

# Size limit
MAX_FILE_SIZE = 10 * 1024 * 1024  # 10MB

# Path traversal prevention
safe_path = os.path.abspath(file_path)
if not safe_path.startswith(os.path.abspath(upload_dir)):
    raise ValueError("Invalid file path")

def validate_file_upload(filename: str, file_size: int) -> tuple[bool, str]:
    """Validate uploaded file."""
    # Check extension
    ext = Path(filename).suffix.lower()
    if ext not in ALLOWED_EXTENSIONS:
        return False, f"File type {ext} not allowed"
    
    # Check size
    if file_size > MAX_FILE_SIZE:
        return False, "File too large"
    
    # Sanitize filename
    safe_name = "".join(c for c in filename if c.isalnum() or c in '._- ')
    if not safe_name or safe_name.startswith('.'):
        return False, "Invalid filename"
    
    return True, ""

# ✅ CORRECT
cursor.execute('SELECT * FROM sessions WHERE id = ?', (session_id,))

# ❌ WRONG
cursor.execute(f'SELECT * FROM sessions WHERE id = {session_id}')

def save_session(topic: str, persona: str, state: dict):
    """Save session with sanitized inputs."""
    # Sanitize inputs
    topic = validate_topic(topic)
    persona = persona if persona in ALLOWED_PERSONAS else "general"
    
    # Serialize safely
    state_json = json.dumps(state, default=str)
    
    # Parameterized insert
    cursor.execute(
        'INSERT INTO sessions (topic, persona, state_json) VALUES (?, ?, ?)',
        (topic, persona, state_json)
    )

from slowapi import Limiter
from slowapi.util import get_remote_address

limiter = Limiter(key_func=get_remote_address)

@limiter.limit("10/minute")
def research_endpoint(request):
    """Rate-limited research endpoint."""
    # ... research logic

def verify_api_key(api_key: str) -> bool:
    """Verify API key from request header."""
    valid_keys = os.getenv("VALID_API_KEYS", "").split(",")
    return api_key in valid_keys

@app.before_request
def check_auth():
    api_key = request.headers.get("X-API-Key")
    if not verify_api_key(api_key):
        abort(401, "Invalid API key")

from flask_cors import CORS

# Restrict origins in production
CORS(app, origins=[
    "https://yourdomain.com",
    "https://app.yourdomain.com"
])

def sanitize_content(content: str, max_length: int = 50000) -> str:
    """Sanitize research content."""
    # Remove scripts
    content = re.sub(r'<script.*?</script>', '', content, flags=re.IGNORECASE | re.DOTALL)
    
    # Remove javascript: URLs
    content = re.sub(r'javascript:', '', content, flags=re.IGNORECASE)
    
    # Truncate if too long
    if len(content) > max_length:
        content = content[:max_length] + "..."
    
    return content.strip()

def safe_llm_prompt(user_input: str) -> str:
    """Create safe prompt from user input."""
    # Remove prompt injection attempts
    dangerous_patterns = [
        r'ignore previous instructions',
        r'disregard.*above',
        r'new instructions:',
    ]
    
    for pattern in dangerous_patterns:
        if re.search(pattern, user_input, re.IGNORECASE):
            raise ValueError("Invalid input detected")
    
    return user_input

import logging

security_logger = logging.getLogger('security')

def log_security_event(event_type: str, details: dict):
    """Log security-relevant events."""
    security_logger.warning(
        f"Security Event: {event_type}",
        extra={
            'event_type': event_type,
            'timestamp': datetime.now().isoformat(),
            **details
        }
    )

# Usage
log_security_event('invalid_input', {
    'user_ip': request.remote_addr,
    'input': sanitized_input
})

from collections import defaultdict
from datetime import datetime, timedelta

failed_attempts = defaultdict(list)

def check_rate_limit(ip_address: str) -> bool:
    """Check if IP has too many failed attempts."""
    now = datetime.now()
    cutoff = now - timedelta(minutes=15)
    
    # Clean old attempts
    failed_attempts[ip_address] = [
        t for t in failed_attempts[ip_address] if t > cutoff
    ]
    
    # Check limit
    if len(failed_attempts[ip_address]) >= 5:
        log_security_event('rate_limit_exceeded', {'ip': ip_address})
        return False
    
    return True