A regex DLP layer for an LLM gateway: blocking keys, masking IDs, and what to do with chat history

说明与用途

用于LLM网关的正则DLP层，阻止密钥、掩码ID并处理聊天历史

问题

LLM gateways need a fast, predictable DLP layer to block or mask sensitive data before requests leave the network, but many implementations only forward traffic without protecting secrets.

结果

The gateway now blocks API keys, masks card numbers and IDs, and replaces historical block matches with placeholders, reducing data leakage risk while maintaining low latency.

工作流

• Load DLP rules from JSON config on each request
• Scan only the last user message for regex matches
• If a match is found, apply the rule’s action: log, mask, or block
• For historical messages, replace block matches with a [redacted] placeholder
• Return the modified request or a 4xx error if blocked
• Log all hits for audit and tuning

证据

The engine caps rules at 50. That's not a technical limitation — it's a design statement.

来源

Only scan the last user message. History hits are handled differently: if a historical message matches a block rule, it's replaced wholesale with a [redacted] placeholder.

来源