// ❌ BAD: Hardcoded API keys
let api_key = "sk-1234567890abcdef";
let provider = OpenAIProvider::new(api_key);

// ❌ BAD: Keys in version control
// config.toml
api_key = "sk-1234567890abcdef"

// ❌ BAD: Keys in logs
println!("Using API key: {}", api_key);

// ✅ GOOD: Environment variables
use std::env;

let api_key = env::var("OPENAI_API_KEY")
    .expect("OPENAI_API_KEY not set");
let provider = OpenAIProvider::new(api_key);

// ✅ GOOD: .env file (not in git)
// .env
OPENAI_API_KEY=sk-...
ANTHROPIC_API_KEY=sk-ant-...

// .gitignore
.env

// ✅ GOOD: Redacted logging
println!("Using API key: {}***", &api_key[..8]);

// Validate configuration before use
pub fn validate_config(config: &Config) -> Result<(), ConfigError> {
    // Check for suspicious values
    if config.providers.is_empty() {
        return Err(ConfigError::NoProviders);
    }

    // Validate URLs
    for provider in &config.providers {
        if !provider.endpoint.starts_with("https://") {
            return Err(ConfigError::InsecureEndpoint(
                provider.endpoint.clone()
            ));
        }
    }

    Ok(())
}

// Always use HTTPS
let provider = OpenAIProvider::builder()
    .api_key(api_key)
    .base_url("https://api.openai.com/v1")  // ✅ HTTPS
    .verify_ssl(true)  // ✅ Verify certificates
    .build();

// Example: AWS Secrets Manager
use aws_sdk_secretsmanager::Client;

async fn get_api_key() -> Result<String, Box<dyn std::error::Error>> {
    let config = aws_config::load_from_env().await;
    let client = Client::new(&config);

    let secret = client
        .get_secret_value()
        .secret_id("llm-api-keys/openai")
        .send()
        .await?;

    Ok(secret.secret_string().unwrap().to_string())
}

// Example: HashiCorp Vault
use vaultrs::client::{VaultClient, VaultClientSettingsBuilder};

async fn get_api_key() -> Result<String, Box<dyn std::error::Error>> {
    let client = VaultClient::new(
        VaultClientSettingsBuilder::default()
            .address("https://vault.example.com")
            .token(env::var("VAULT_TOKEN")?)
            .build()?
    )?;

    let secret = client
        .read("secret/data/llm-api-keys")
        .await?;

    Ok(secret["data"]["openai_key"].as_str().unwrap().to_string())
}

// Validate user inputs
pub fn validate_prompt(prompt: &str) -> Result<(), ValidationError> {
    // Check length
    if prompt.is_empty() {
        return Err(ValidationError::EmptyPrompt);
    }

    if prompt.len() > MAX_PROMPT_LENGTH {
        return Err(ValidationError::PromptTooLong);
    }

    // Check for suspicious content
    if contains_injection_patterns(prompt) {
        return Err(ValidationError::SuspiciousContent);
    }

    Ok(())
}

// Don't expose sensitive information in errors
pub enum Error {
    // ❌ BAD: Exposes API key
    AuthError(String),

    // ✅ GOOD: Generic error
    AuthenticationFailed,
}

// Error messages
impl Display for Error {
    fn fmt(&self, f: &mut Formatter) -> fmt::Result {
        match self {
            // ❌ BAD: Exposes details
            Error::AuthError(key) => write!(f, "Auth failed with key: {}", key),

            // ✅ GOOD: Generic message
            Error::AuthenticationFailed => write!(f, "Authentication failed"),
        }
    }
}

use llm_latency_lens::RateLimiter;

let limiter = RateLimiter::new()
    .requests_per_second(10)
    .burst(20)
    .build();

let request = StreamingRequest::builder()
    .model("gpt-4")
    .prompt("Hello")
    .timeout(Duration::from_secs(30))  // 30 second timeout
    .build();

use tracing_subscriber::fmt::format::FmtSpan;

tracing_subscriber::fmt()
    .with_env_filter("llm_latency_lens=info")
    .with_span_events(FmtSpan::CLOSE)
    .json()  // Structured logging
    .init();