DS DevShelfHub Projects · AI tools
Tutorials / CrewAI / Reference / Classes / SecurityConfig
Class security

SecurityConfig: Reference Guide

By DevShelfHub

Configures crew-level security: fingerprints, redaction patterns, telemetry safety.

See the CrewAI API reference index, CrewAI introduction, and core concepts for surrounding context.

What is SecurityConfig?

SecurityConfig is the Crew-scoped knob for how CrewAI identifies entities in telemetry and how much raw prompt text can leak into logs. Fingerprints are stable, hashable identifiers auto-generated for each Agent and Crew so vendors can aggregate runs without storing customer role names or backstories. Redaction hooks complement that story by scrubbing known PII patterns before events leave the process.

The object does not replace network security: it will not block outbound tool calls or validate TLS. Treat it as hygiene for observability pipelines — pair it with secrets managers for API keys, egress allow lists for tools, and centralized log sinks that classify payloads. When upgrading CrewAI, re-read release notes: new telemetry fields occasionally appear and your redaction regexes may need expansion.

Defaults skew toward safer telemetry for hosted dashboards. If you run air-gapped, you may still want defaults enabled so accidental copy/paste of traces into tickets does not expose end-user content verbatim.

When to Use

Production crews that ingest user-provided text, regulated industries, or any deployment where traces leave the VPC.

Use Cases

  • • PII-safe tracing
  • • Per-agent telemetry IDs
  • • SOC2-friendly log pipelines
  • • Customer-data segregation in APM

Key Features

  • ✓ Auto-fingerprints
  • ✓ Redaction config
  • ✓ Telemetry hooks
  • ✓ Crew-level scoping

When NOT to Use

Throwaway notebooks where verbose stdout is the only sink and no shared logging exists.

Notes

Fingerprints are not secrets

They identify entities, not authenticate them. Anyone with log access can correlate fingerprints across runs — still safer than logging raw role strings, but not a substitute for access control on the log backend.

Redaction is regex-sharp

Overly broad patterns can strip legitimate model outputs (e.g., masking every 16-digit number including non-card data). Start with vendor-recommended defaults, add org-specific tokens, and regression-test with synthetic transcripts.

Hooks vs listeners

SecurityConfig shapes what CrewAI emits by default; custom listeners can still leak if they print ctx.prompt verbatim. Audit both paths before declaring a crew GDPR-safe.

Version drift

Telemetry schemas evolve between minor releases. Pin CrewAI in requirements files and diff release notes when bumping — new keys may bypass older redaction lists.

Import

python 
from crewai.security import SecurityConfig

Code Examples

Explicit default on a production crew

python 
from crewai import Crew, Agent, Task, Process
from crewai.security import SecurityConfig

crew = Crew(
    agents=[researcher, writer],
    tasks=[t1, t2],
    process=Process.sequential,
    security_config=SecurityConfig(),
    verbose=True,
)

Combine with observability tutorial patterns

python 
# SecurityConfig complements BaseEventListener hooks:
# listeners forward structured fields; SecurityConfig keeps payloads scrubbed.
from crewai.security import SecurityConfig
from crewai import Crew

crew = Crew(..., security_config=SecurityConfig())

Correlate agents in logs without role names

python 
import logging
from crewai import Crew
from crewai.security import SecurityConfig

log = logging.getLogger('crew.telemetry')

crew = Crew(agents=[researcher], tasks=[t1], security_config=SecurityConfig())
for agent in crew.agents:
    log.info('agent_fp=%s role=%s', agent.fingerprint, agent.role)

Common Mistakes

❌ Trying to override the fingerprint manually

✅ Fingerprints are auto-assigned and immutable — correlate via metadata you control outside CrewAI.

❌ Assuming SecurityConfig blocks malicious tools

✅ Use allow lists, human approval, or Flow gates for tool policy; SecurityConfig focuses on telemetry hygiene.

SecurityConfig FAQ

What is SecurityConfig in CrewAI?

Configures crew-level security: fingerprints, redaction patterns, telemetry safety. SecurityConfig is the Crew-scoped knob for how CrewAI identifies entities in telemetry and how much raw prompt text can leak into logs. Fingerprints are stable, hashable identifiers auto-generated for each Agent and Crew so vendors can aggregate runs without storing customer role names or backstories. Redaction hooks complement that story by scrubbing known PII patterns before events leave the process. The object does not replace network security: it will not block outbound …

Which package defines the CrewAI class SecurityConfig?

DevShelfHub maps SecurityConfig to Python module crewai.security (package path crewai.security in this reference). Pin your installed crewai version and match imports to the snippet on this page.

When should I use SecurityConfig?

Production crews that ingest user-provided text, regulated industries, or any deployment where traces leave the VPC.

When should I avoid using SecurityConfig?

Throwaway notebooks where verbose stdout is the only sink and no shared logging exists.

How do I import SecurityConfig in Python?

from crewai.security import SecurityConfig

Where can I explore more CrewAI API reference pages?

Open the CrewAI API reference index on DevShelfHub to search 58 classes, 30 methods, and 16 decorators, each with runnable examples, parameters, common mistakes, and cross-links.