EmergencyEcho is a Voice AI health assistant handling emergency health guidance and sensitive voice data from users who may be in crisis. As the platform approached readiness for clinical partnerships, it had no formal security posture — no threat modelling, no data protection impact assessment, no incident response capability. I led the security documentation workstream end-to-end and, during architecture review, identified a critical hardcoded API key exposure that was escalated and remediated before any clinical data onboarding.
- A Groq API key was hardcoded directly into a VAPI/n8n workflow — an immediately exploitable credential exposure, escalated to the CTO and clinical co-CEOs the same day it was found
- 17 findings documented across Critical/High/Medium/Low severity, spanning voice-data encryption, access control, rate limiting, and audit logging gaps
- A full DPIA was produced aligned to Nigeria's NDPA 2023 and NDPC GAID 2025 — a regulatory bar the platform needed to clear before MDCN/NMCN clinical engagement
- Documentation was built to be maintained, not archived — the platform was under active development throughout the assessment
The Problem
EmergencyEcho's stack — Next.js frontend, Supabase backend, VAPI for voice AI, n8n for workflow automation — handled sensitive health data and voice interactions from users potentially in crisis, with no structured security review behind it. For a platform seeking engagement with MDCN and NMCN, this was a critical gap: no credible regulatory or clinical partner would engage without evidence of a formal security and data protection framework.
The Approach
I led the security documentation workstream from scoping through delivery, adapted for a consumer-facing health application in a Nigerian regulatory environment:
- Architecture review — analysed the technical stack, data flows, integration points, and trust boundaries
- Threat modelling — identified threat actors, attack surfaces, and risk scenarios specific to a voice AI health platform
- Vulnerability identification — structured review producing 17 documented findings across four severity tiers
- Data protection assessment — full DPIA under NDPA 2023 and NDPC GAID 2025
- Framework and playbook development — voice data handling, incident response, and QR-based emergency access
The EmergencyEcho founding team — clinical, technical, and design leadership alongside the cybersecurity function
A Groq API key was found hardcoded directly into a VAPI n8n workflow — any party with access to the workflow configuration could extract and abuse it under the platform's account. Escalated immediately to the CTO and both clinical co-CEOs with a clear remediation instruction: remove, rotate, and move to environment-variable secret management.
Findings Summary
The Security Assessment Report v2.1 documented 17 findings. Selected examples by tier:
- Critical — hardcoded API credentials in workflow automation
- High — no voice data encryption-at-rest policy, no defined retention/deletion schedule for health recordings, missing rate limiting on voice API endpoints, no audit logging for administrative actions
- Medium — insufficient input validation on health intake forms, Supabase RLS policies requiring tightening, no third-party vendor security assessment for the VAPI integration, missing CSP headers
- Low — session timeout configuration, dependency version audit, QR emergency access authentication boundary documentation
Challenges
Assessing a moving target. The platform was under active development throughout — new architecture documents introduced mid-assessment, including the one that revealed the hardcoded key, meant findings required continuous updating rather than a single point-in-time review.
Regulatory context complexity. NDPA 2023 and NDPC GAID 2025 are relatively recent instruments with no existing guidance specific to voice AI health platforms — applying them required careful, conservative interpretation where ambiguous.
Multi-stakeholder communication. The founding team spans clinical co-CEOs, a technical CTO, and business leadership with different security literacy levels — communicating 17 findings accurately for the CTO while remaining actionable for clinical co-founders required deliberate translation across the documentation.
Results
- Full security documentation suite produced — the platform moved from zero formal security posture to a comprehensive, regulator-ready stack
- Critical credential exposure identified and escalated before the platform went live with clinical partners
- DPIA produced to NDPA 2023 / NDPC GAID 2025 standard — meeting the threshold requirement for regulatory partnership engagement
- MOU frameworks drafted for MDCN and NMCN engagement, removing a key blocker to clinical validation
- Incident Response Playbook in place before any clinical data onboarding began
Lessons Learned
Security review should begin at architecture design, not pre-launch — the hardcoded key was preventable at the point of workflow design with a lightweight threat model up front. Documentation is a product, not a deliverable: the security framework only has lasting value if it's actively maintained as the platform evolves, so I built the playbook and DPIA in formats designed to be updated, not archived.
What I'd Improve
- Introduce automated secret scanning into the CI/CD pipeline from day one — catching credential exposure at commit time, not through manual review
- Implement a formal change-management process so architecture updates trigger an automatic security review checkpoint
- Build a lightweight plain-language security dashboard for non-technical co-founders
- Conduct a formal tabletop exercise with the full founding team using the Incident Response Playbook within 30 days of publication
References
- Nigeria Data Protection Act 2023 (NDPA 2023)
- NDPC General Application and Implementation Directive 2025 (NDPC GAID 2025)