def safe_prompt_injection(user_input: str, prompt_template: str) -> str:
    """Safely inject user input into prompts"""
    # Sanitize user input
    sanitized = user_input.strip()

    # Escape special characters if needed
    sanitized = sanitized.replace("{", "{{").replace("}", "}}")

    # Use template with clear boundaries
    return prompt_template.format(user_input=sanitized)

# Example usage
from baytos.claro import BaytClient

client = BaytClient(api_key=os.getenv("BAYT_API_KEY"))
prompt = client.get_prompt("@workspace/qa-bot:v1")

# Inject user input safely
full_prompt = safe_prompt_injection(
    user_input="What are your hours?",
    prompt_template=f"{prompt.generator}\n\nUser question: {{user_input}}"
)

import re

def redact_sensitive_data(text: str) -> str:
    """Redact PII from logs and prompts"""
    # Email addresses
    text = re.sub(r'\b[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Z|a-z]{2,}\b',
                  '[EMAIL_REDACTED]', text)

    # Phone numbers
    text = re.sub(r'\b\d{3}[-.]?\d{3}[-.]?\d{4}\b',
                  '[PHONE_REDACTED]', text)

    # Credit cards
    text = re.sub(r'\b\d{4}[-\s]?\d{4}[-\s]?\d{4}[-\s]?\d{4}\b',
                  '[CARD_REDACTED]', text)

    return text

# Use before logging
logger.info(f"User query: {redact_sensitive_data(user_query)}")

import logging
from datetime import datetime

# Configure security logging
security_logger = logging.getLogger('security')
handler = logging.FileHandler('security.log')
handler.setFormatter(logging.Formatter(
    '%(asctime)s - %(name)s - %(levelname)s - %(message)s'
))
security_logger.addHandler(handler)
security_logger.setLevel(logging.INFO)

# Log security events
def log_api_call(user_id: str, action: str, success: bool):
    security_logger.info({
        'timestamp': datetime.utcnow().isoformat(),
        'user_id': user_id,
        'action': action,
        'success': success,
        'ip': request.remote_addr  # If using Flask/Django
    })

# Usage
log_api_call(
    user_id="user_123",
    action="get_prompt",
    success=True
)

from functools import wraps
from flask import request, jsonify

def require_auth(f):
    @wraps(f)
    def decorated_function(*args, **kwargs):
        # Verify user authentication
        auth_header = request.headers.get('Authorization')

        if not auth_header or not verify_token(auth_header):
            return jsonify({'error': 'Unauthorized'}), 401

        return f(*args, **kwargs)
    return decorated_function

@app.route('/api/ask')
@require_auth  # Always protect AI endpoints
def ask_question():
    # Your prompt logic
    pass

from flask_limiter import Limiter
from flask_limiter.util import get_remote_address

limiter = Limiter(
    app,
    key_func=get_remote_address,
    default_limits=["100 per hour"]
)

@app.route('/api/ask')
@limiter.limit("10 per minute")  # Limit AI endpoint usage
def ask_question():
    # Your prompt logic
    pass