Azure Foundry credentials must stay in Azure App Service application settings, Key Vault, or local .env files that are ignored by git. Never put Azure keys in the iOS app bundle.

The FastAPI backend includes:

• task allow-listing
• request size checks
• context size checks
• in-memory rate limiting
• configurable CORS
• safe Azure error messages
• optional X-FitAgent-Api-Key gate for non-local deployments

For a public App Store release, add Sign in with Apple or another real user auth flow. An app API key embedded in a mobile client can slow casual abuse but is not a durable security boundary.

For private development, rotate exposed keys immediately and redeploy the Azure App Service after updating settings.