vector database security

Guide to hardening a RAG stack with standard Linux tools, detailing risks across ingest, index, retrieve, and generate, then delivering five copy‑paste steps: gate/scan/redact corpus with ACLs; sandbox embeddings/retrieval via firejail; deny‑by‑default egress with nftables; safe Bash wrappers for file/HTTP plus retrieval budgets; and provenance via SQLite hashes and GPG signatures—yielding auditable, least‑privilege RAG.