speak-security-basics

# Speak Security Basics ## Overview Security best practices for Speak API keys, audio data privacy, student data protection, and COPPA/FERPA compliance. ## Prerequisites - Completed `speak-install-auth` setup - Valid API credentials configured - ffmpeg installed for audio processing ## Instructions ### API Key Security ```bash # Never commit API keys echo '.env' >> .gitignore echo '.env.local' >> .gitignore # Use secrets manager in production export SPEAK_API_KEY="$(aws secretsmanager get-secret-value --secret-id speak/api-key --query SecretString --output text)" ``` ### Audio Data Privacy ```typescript // Speak processes audio on their servers — do NOT store student audio locally // unless required by your application class PrivacyAwareClient { async assessAndClean(audioPath: string, targetText: string, language: string) { try { const result = await this.client.assessPronunciation({ audioPath, targetText, language, }); return result; } finally { // Delete local audio file after assessment fs.unlinkSync(audioPath); } } } ``` ### Student Data Protection - Never log student audio recordings - Redact student names from API logs - Store assessment scores, not raw audio - Implement data retention policies (delete after N days) - COPPA compliance for students under 13: parental consent required - FERPA compliance for educational institutions: student data agreements ### Security Checklist - [ ] API keys in secrets manage...