fireflies-security-basics

# Fireflies.ai Security Basics ## Overview Security essentials for Fireflies.ai: API key management, webhook HMAC-SHA256 signature verification, transcript access controls, and audit practices. ## Prerequisites - Fireflies.ai API key - Understanding of environment variables - HTTPS endpoint for webhooks (required by Fireflies) ## Instructions ### Step 1: Secure API Key Storage ```bash # .env (NEVER commit) FIREFLIES_API_KEY=your-api-key FIREFLIES_WEBHOOK_SECRET=your-16-to-32-char-secret # .gitignore .env .env.local .env.*.local ``` **Pre-commit hook to catch leaked keys:** ```bash #!/bin/bash # .git/hooks/pre-commit if git diff --cached --name-only | xargs grep -l 'FIREFLIES_API_KEY\s*=' 2>/dev/null; then echo "ERROR: Potential API key in commit. Remove before committing." exit 1 fi ``` ### Step 2: Webhook Signature Verification (HMAC-SHA256) Fireflies signs webhook payloads with HMAC-SHA256. The signature arrives in the `x-hub-signature` header. ```typescript import crypto from "crypto"; function verifyFirefliesWebhook( payload: string, signature: string, secret: string ): boolean { const expected = crypto .createHmac("sha256", secret) .update(payload) .digest("hex"); // Timing-safe comparison prevents timing attacks return crypto.timingSafeEqual( Buffer.from(signature), Buffer.from(expected) ); } // Express middleware import express from "express"; const app = express(); app.post("/webhooks/fireflies", express.raw({ type: ...