# ✅ Good: Sanitize sensitive data in logs
logger.info(f"Investigating email: {email[:3]}***@{email.split('@')[1]}")

# ❌ Bad: Logging sensitive data
logger.info(f"API key: {api_key}")  # Never log API keys!

# ✅ Good: Always use HTTPS
async with session.get("https://api.service.com/data") as resp:
    # Handle response

# ❌ Bad: Never use HTTP for sensitive data
async with session.get("http://api.service.com/data") as resp:  # Insecure!
    # Handle response

# Default behavior includes certificate verification
connector = aiohttp.TCPConnector(ssl=True)  # ✅ Good
session = aiohttp.ClientSession(connector=connector)

# Never disable SSL verification in production
connector = aiohttp.TCPConnector(ssl=False)  # ❌ Dangerous!

class ResponsiblePlugin(PluginBase):
    def __init__(self):
        self.rate_limiter = asyncio.Semaphore(5)  # Max 5 concurrent requests
        self.last_request = 0
        self.min_interval = 1.0  # 1 second between requests
    
    async def run(self, query, session):
        async with self.rate_limiter:
            # Implement delay between requests
            now = time.time()
            elapsed = now - self.last_request
            if elapsed < self.min_interval:
                await asyncio.sleep(self.min_interval - elapsed)
            
            self.last_request = time.time()
            # Make API request...

# ✅ Good: Honest user agent
headers = {
    "User-Agent": "OSINT-Master-Tool/1.0 (Security Research)"
}

# ❌ Bad: Deceptive user agent
headers = {
    "User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64)"  # Misleading
}

import re
from urllib.parse import urlparse

def validate_email(email: str) -> bool:
    """Validate email format"""
    pattern = r'^[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}$'
    return re.match(pattern, email) is not None

def validate_domain(domain: str) -> bool:
    """Validate domain format"""
    try:
        # Remove protocol if present
        if '://' in domain:
            domain = urlparse(domain).netloc
        
        # Basic domain validation
        pattern = r'^[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}$'
        return re.match(pattern, domain) is not None
    except:
        return False

def validate_ip(ip: str) -> bool:
    """Validate IP address format"""
    try:
        import ipaddress
        ipaddress.ip_address(ip)
        return True
    except ValueError:
        return False

# ✅ Good: Parameterized queries
query = "SELECT * FROM results WHERE email = ?"
cursor.execute(query, (email,))

# ❌ Bad: String concatenation
query = f"SELECT * FROM results WHERE email = '{email}'"  # SQL injection risk!

import logging
from datetime import datetime

def setup_security_logger():
    """Setup security-focused logger"""
    security_logger = logging.getLogger("osint_security")
    handler = logging.FileHandler("security.log")
    formatter = logging.Formatter(
        "[%(asctime)s] SECURITY - %(levelname)s - %(message)s"
    )
    handler.setFormatter(formatter)
    security_logger.addHandler(handler)
    security_logger.setLevel(logging.INFO)
    return security_logger

# Log security events
security_logger = setup_security_logger()

def log_investigation(target_type: str, target_value: str, success: bool):
    """Log investigation attempts"""
    # Sanitize the target value for logging
    if target_type == "email":
        sanitized = f"{target_value[:3]}***@{target_value.split('@')[1]}"
    else:
        sanitized = target_value
    
    security_logger.info(
        f"Investigation - Type: {target_type}, Target: {sanitized}, "
        f"Success: {success}, Timestamp: {datetime.utcnow().isoformat()}"
    )

class SecureAuditLogger:
    def __init__(self, retention_days=30):
        self.retention_days = retention_days
    
    def log_investigation(self, data):
        # Store only necessary data
        audit_data = {
            "timestamp": data["timestamp"],
            "target_type": data["target_type"],
            "target_hash": hashlib.sha256(data["target_value"].encode()).hexdigest(),
            "success": data["success"],
            "plugins_used": data["plugins_used"]
        }
        # Store audit_data...
    
    def cleanup_old_logs(self):
        """Remove logs older than retention period"""
        cutoff_date = datetime.utcnow() - timedelta(days=self.retention_days)
        # Remove old entries...