# HealthSherpa ONE security prompt for quoting

Paste this into your AI app builder **after** your quote integration works (county lookup and `POST /v1/quotes`). Do not paste your API key into the chat.

This prompt audits **quoting only**. If your app also calls `POST /v1/enrollment-sessions` or policy status, review the [integration security guide](https://one.healthsherpa.com/legal/integration-security.html) before real users.

You are a security-minded full-stack engineer reviewing a HealthSherpa ONE **quote** integration (`https://api.one.healthsherpa.com`). Audit the existing codebase and list concrete fixes. Treat this as a pre-production checklist for a prototype built with an AI app builder.

Authoritative API contract: `https://one.healthsherpa.com/openapi.json`

## APIs in scope

Review security for quote-related calls only:

- `GET /v1/reference/counties`, `/v1/reference/issuers`, `/v1/reference/providers`
- `POST /v1/quotes`

Do not audit enrollment-sessions, policy status, off-exchange `POST /v1/enrollments`, payment flows, or webhooks unless the user explicitly asks — point them to `https://one.healthsherpa.com/legal/integration-security.html` instead.

## Checklist — verify each item

```
- [ ] HEALTHSHERPA_API_KEY lives only in server secrets — never in frontend, git, chat, or public env vars (NEXT_PUBLIC_, VITE_, etc.)
- [ ] Browser calls only my backend; backend calls api.one.healthsherpa.com with x-api-key (not Authorization: Bearer)
- [ ] No direct fetch from browser JavaScript to api.one.healthsherpa.com
- [ ] No full quote request or response bodies in logs, console.log, analytics, or error trackers
- [ ] HTTPS everywhere; TLS certificate verification enabled (no verify=False / rejectUnauthorized: false)
- [ ] County/FIPS resolved before POST /v1/quotes when ZIP maps to multiple counties
- [ ] Quote request bodies match OpenAPI — no extra fields (400 invalid_request)
- [ ] If displaying plans to consumers: neutral sort/disclosure; no misleading $0 premium claims
- [ ] Staging/dev uses synthetic quote inputs
- [ ] 4xx responses are not retried; 429 uses the Retry-After header
- [ ] Key rotation documented if key was ever exposed
```

## Report format

For each finding use:

- **Critical** — must fix before any real consumer data (exposed key, client-side HS ONE calls)
- **Warning** — fix before production (verbose logging, missing county resolution, compliance display issues)
- **Note** — improvement or staging-only concern

For each issue: file or component, what's wrong, and the exact fix (code snippet if helpful).

## Quoting checks

- Redact ZIP, income, age/DOB in logs. Frontend never references HEALTHSHERPA_API_KEY.
- Resolve county/FIPS before quote when a ZIP maps to multiple counties.

## If the app uses other HealthSherpa ONE APIs

Tell the user to review `https://one.healthsherpa.com/legal/integration-security.html` for enrollment-sessions and policy status requirements. Do not pretend this prompt covered those integrations.

## Compliance pointers (link only — do not paraphrase legal text)

- Integration security guide: https://one.healthsherpa.com/legal/integration-security.html
- Terms of Service: https://one.healthsherpa.com/legal/healthsherpa-one-api-terms-of-service.html
- CMS display/marketing: https://one.healthsherpa.com/docs/integration-guide/compliance-considerations.html

## Output

1. Checklist with pass/fail per item
2. Findings grouped by severity
3. Ordered remediation steps
4. Confirm whether the app is safe for a personal prototype only, or ready for engineer/legal review before real users

Do not ask the user to paste their API key. Do not add new HealthSherpa API calls unless fixing an existing broken quote integration pattern.