the security posture, documented.
what is actually true, what is measured, and what is still open.
Most security pages describe intentions. This one describes mechanisms — the specific choke point, the specific table, the specific redactor — and where each one was found to be insufficient. The failures below are not hypotheticals. Two of them were live in production.
four rules that did the work
a choke point only protects what flows through it
An egress guard was built and wired into the main model path. It worked. It also protected nine of fifteen outbound paths in the tree, because six had never been counted. One was a second complete LLM path sending page context straight to a provider. Another posted directly to a provider from a legacy module. Another sent webhook payloads unscrubbed. The guard was correct — the inventory was not.
a local host is never evidence of a local model
Every cloud request in this fleet goes through a local proxy. A rule that decides "is this egress?" by looking only at the hostname therefore classifies everything as local — and the guard protects nothing while appearing fully configured. The decision has to be made on model family and proxy route as well as address. Anything resolving to loopback and carrying a cloud model name is cloud egress.
fail closed, and make a missing module fail closed too
If the redaction step throws, the request is blocked, not logged and passed through. If the redaction module is missing, the request is also blocked — because a missing module that degrades to "allow" is a silent bypass. The same rule applies to the egress tripwire: absent or malformed means no request.
test a redactor in both directions
Recall and precision. A redactor that masks a commit hash corrupts the diff it was meant to protect, silently, and the corruption looks like authoring. The fleet's redactor measures 13/13 on the leak battery and 4/10 → 2/10 false positives after the over-masking rules were written into it. Reporting one number without the other is lying.
the layers
input[type=password] unconditionally. It now defaults to block and hand off to a human, with explicit approve and allow modes, and an unknown policy fails safe to block.measured, not asserted
found when the paths were counted properly for the first time. The other six are now closed.
recall on a battery of planted secrets. Precision is 2/10 false positives.
multi-word vendor spans, up from 86, added so real names stop being masked.
untouched chain reports VERIFIED; one edited field localises the tamper to its sequence number.
what we do not catch
These are the open gaps. They are listed here because a security page that only reports coverage is a marketing page.
A full private key block, with its header, is not matched. Whether a bare key body is caught depends on whether the surrounding text gives the field name away.
The 40-character secret half of an AWS key pair is not matched by the structural rules. The access-key-id half is. This is the classic shape of a partial rule: one half covered, the other not, and the coverage looks complete.
The masker keeps a bounded vault of placeholder-to-original mappings. When it fills, the oldest mapping is evicted — and when a later response contains a placeholder whose original is gone, the restore step leaves the placeholder in place rather than failing. The model's output then contains a literal token that gets written into generated code as a string. It was found by inspection, not by alarm: there was no observable signal across 152,000 log lines. The real fix is to stop masking inside fenced code blocks.
A redactor does not make a system HIPAA-compliant. HIPAA offers Safe Harbor — eighteen specific identifier classes — or Expert Determination, and neither is a regex. Nothing on this page is a compliance certification, and this site makes no claim to be one.
take the kit
the security kit
Eight files, all public-safe: the nftables table, the egress inventory and its anti-regression gate, the redactor rules, the audit chain spec, a 14-rule secret scanner config, and a sixteen-question DLP checklist. Everything is a template — change the interface names to match your box.
Everything in the kit is tested before it ships. The coverage gate runs green out of the box against its own fixture tree.
The most useful single thing in the kit is not a control. It is a habit: count the paths before claiming coverage. The guard that protected nine of fifteen paths was not a bad guard. It was a good guard with an incomplete inventory — and the inventory was the part nobody had written down.
methodology documented 2026-10-16 · no credentials, hostnames or client names published