What security best practices should you follow for LangChain applications?

LangChain applications interact with LLMs, external tools, and user-supplied data, creating several attack surfaces that require explicit mitigation:

• Prompt injection prevention — the most critical LLM-specific risk. Malicious users craft inputs that override system instructions (e.g. 'Ignore all previous instructions and...'). Mitigate with input sanitisation, structural separation of user input from system context, and output validation that rejects responses that claim to override system behaviour.
• Secrets management — never hardcode API keys in source code or commit them to version control. Use environment variables, .env files (excluded from git), or a secrets manager (AWS Secrets Manager, HashiCorp Vault, GCP Secret Manager).
• Tool permission minimisation — agents with write access to databases, file systems, or APIs can cause significant damage if manipulated via prompt injection. Grant tools the minimum permissions required: read-only where possible, scoped API tokens.
• Human-in-the-loop for irreversible actions — use LangGraph's interrupt_before to pause before any tool that modifies data, deletes files, or sends emails, requiring human approval.
• Output filtering — validate and filter LLM outputs for PII, harmful content, or off-topic responses before returning to users. Libraries like Guardrails AI or NeMo Guardrails integrate with LangChain.
• Rate limiting on LangServe endpoints — prevent abuse and runaway costs from unauthenticated requests using API gateway rate limiting or middleware.