In Smarter, a Django platform for hosting LLM chatbots, every chat session is bound to the one chatbot that created it, and the server checks that binding on every request. A session key that belongs to a different chatbot is…

Smarter makes two security decisions in its Django configuration. Outside local development it refuses to start with a missing or published SECRET_KEY, and it counts every API rate limit in Redis, so that twenty pods enforce one limit rather than…

Django’s ALLOWED_HOSTS setting is a fixed list, and Smarter serves a hostname for every chatbot that every account creates. This post describes how Smarter validates the HTTP Host header anyway, with a static list in Django’s settings that admits the…

Smarter keeps every credential that its resources need, from provider API keys and database passwords to MCP server tokens and search API keys, in one Django model, Secret, whose value is stored as Fernet ciphertext from the Python cryptography package.…