promptsanitizer

Secrets firewall for AI pipelines.

promptsanitizer helps redact, block, and audit sensitive data before it reaches an LLM — and before risky model outputs leave your application.

Why this exists

AI systems often pass user input, retrieved documents, tool outputs, and model responses through LLMs. That text can contain API keys, credentials, PII, or prompt injection attempts.

What it checks

• API keys, tokens, passwords, private keys, and cloud credentials
• PII such as emails, phone numbers, SSNs, credit cards, and IP addresses
• Prompt injection and jailbreak-style instructions
• Risky code execution patterns
• Exfiltration indicators such as internal URLs, metadata endpoints, and webhook-style payloads

Install

pip install promptsanitizer

Optional integrations:

pip install "promptsanitizer[openai]"
pip install "promptsanitizer[anthropic]"
pip install "promptsanitizer[all]"

Quick Start

from promptsanitizer import Firewall

fw = Firewall()

text = "My API key is sk-proj-xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"
safe_text = fw.clean(text)

print(safe_text)

My API key is [REDACTED:openai_key]

Core features

• Inbound prompt scanning
• Outbound response scanning
• Redaction, blocking, and audit-only modes
• Default, strict, audit, and custom policies
• CLI support
• OpenAI and Anthropic middleware wrappers
• Compliance-style findings and reports
• Custom detection patterns

Findings privacy and history

Findings omit raw matched values by default. History retains the latest 1,000 findings; use history_limit=0 to disable it, or set another limit for your application.

fw = Firewall(history_limit=100)
findings = fw.scan("email: dev@example.com")
print(findings[0].to_dict())  # Metadata only, without the matched email.

Strict mode blocks credentials and attack indicators, including generic API keys and exfiltration indicators. Scans preserve overlapping candidates so every blocking rule is evaluated. Private-key redaction covers complete blocks; an incomplete block is redacted through the end of the input.

See security behavior and migration notes for the policy matrix, raw-value opt-in, reporting semantics, and middleware coverage.

Who should use this

• AI engineers
• ML platform teams
• Security engineers
• Researchers
• Teams building agents, RAG systems, copilots, and AI assistants

Examples

Detailed examples are kept in the examples/ folder to keep this README simple.

examples/
  basic_clean.py
  strict_policy.py
  custom_policy.py
  prompt_injection_detection.py
  outbound_response_scan.py
  compliance_report.py
  openai_middleware.py
  anthropic_middleware.py
  cli_scan.sh
  cli_report.sh

CLI

promptsanitizer scan "email: dev@example.com"

promptsanitizer clean "my key is sk-proj-xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"

promptsanitizer report --file prompt.txt

Where it fits

User input
  -> promptsanitizer
  -> LLM / agent / RAG pipeline
  -> promptsanitizer
  -> user / logs / downstream systems

Limitations

promptsanitizer is a defensive scanning layer, not a complete security boundary. Use it alongside access controls, secret management, logging controls, tool isolation, and output validation.