FluentLoop is a Telegram bot for an owner-curated admitted-user audience. The operational surface is still small: one bot, one VPS, one Docker container, and one set of secrets. The sensitive part is the learning data, which may contain real names of colleagues, clients, and projects. This file documents what is protected, what is sent to third parties, and what to do when something goes wrong.

• Admitted Telegram users, single VPS, single Docker container. Low attack surface, but per-user lesson progress and private uploads must stay isolated.
• No public web endpoint in MVP (Telegram is the only interface).
• Realistic risks:
  • Accidental commit of .env or a leaked token in a log line.
  • AI provider data retention — anything sent to OpenAI / Anthropic / DeepSeek is governed by their terms.
  • VPS compromise via SSH (mitigated by key-only auth, fail2ban — handled in a deployment epic later).
• Not in scope for MVP: DDoS, advanced threat actors, sophisticated exfiltration. This is a personal tool.

The bot sends user-generated text to the configured AI provider for three purposes:

1. Extraction (PRD §25.1) — uploaded lesson notes, word lists, teacher feedback are sent verbatim to the AI to identify candidate learning items.
2. Exercise generation (PRD §25.2) — approved learning items, progress state, and weakness signals are sent so the AI can generate exercises.
3. Answer checking (PRD §25.3) — exercise prompts and the user's answers are sent so the AI can judge them and produce feedback.

What this means in practice:

• The offline roadmap editor makes no network requests. Its public syllabus contains no learner data; personal order and notes stay in browser storage or downloaded JSON until explicitly imported. CLI exports use mode 600. Personal exports belong outside tracked files, preferably under data/. Roadmap settings/notes are not sent to AI providers and cannot grant assessed mastery.
• Simple choice questions from the reviewed pack and existing approved cards are selected and checked locally. An optional written bonus uses the existing AI answer-checking path and sends its prompt and submitted sentence to the configured provider. Attempts and personal progress stay in the private DB.
• Bounded simple-bank expansion sends curated question prompts, choices, and target constructions to the configured provider to draft and independently check new variants. Raw learner answers are not sent in those prompts. A reported question is excluded from that learner's selection while its report remains in the private DB.
• Lesson notes may contain colleague names, client names, internal project names, and informal commentary. All of that is transmitted to the chosen AI provider.
• Provider data retention follows the published terms for the configured AI provider.
• The user must consciously decide they accept this. There is no way to build the product without it.

Optional mitigation — redaction list. A simple regex-based redactor can replace user-maintained sensitive tokens (real names, project codenames) with placeholders like [COLLEAGUE_1], [PROJECT_X] before sending text to the AI. This is captured as a P1 enhancement, not MVP-blocking. See docs/architecture.md (TODO section) when it is filled in.

• Real values live only in .env (local), in the VPS environment, or in a password manager. Never in git, commit messages, logs, or example files.
• .env.example is the only env file tracked. It contains placeholders only.
• Confidential deploy-only values may live in secrets/deploy.env (gitignored, mode 600). See docs/runbooks/secrets-management.md.
• Pre-commit checklist:
  • python3 scripts/secret_scan.py must return secret-scan: ok.
  • No real Telegram user IDs (numeric IDs are personally identifying).
  • No email addresses.
• If a secret leaks: rotate immediately (BotFather /revoke, AI provider dashboard), force-push a clean history (with explicit user permission), audit logs.

Before pushing to a remote (when there is one):

1. git status — no .env, no data/, no secrets/, no *.session.
2. python3 scripts/secret_scan.py returns secret-scan: ok.
3. No real numeric Telegram user IDs in tracked files.
4. PRD / epic / ADR docs reflect any behavior change in this commit.