A regex DLP layer for an LLM gateway: blocking keys, masking IDs, and what to do with chat history

Описание и применение

Регулярный слой DLP для шлюза LLM, блокирующий ключи, маскирующий ИД и управляющий историей чата

Задача

LLM gateways need a fast, predictable DLP layer to block or mask sensitive data before requests leave the network, but many implementations only forward traffic without protecting secrets.

Результат

The gateway now blocks API keys, masks card numbers and IDs, and replaces historical block matches with placeholders, reducing data leakage risk while maintaining low latency.

Рабочий процесс

• Load DLP rules from JSON config on each request
• Scan only the last user message for regex matches
• If a match is found, apply the rule’s action: log, mask, or block
• For historical messages, replace block matches with a [redacted] placeholder
• Return the modified request or a 4xx error if blocked
• Log all hits for audit and tuning

Доказательства

The engine caps rules at 50. That's not a technical limitation — it's a design statement.

Источник

Only scan the last user message. History hits are handled differently: if a historical message matches a block rule, it's replaced wholesale with a [redacted] placeholder.

Источник