# How OmniRoute Guardrails Handle PII Masking and Credential Redaction

> Discover how OmniRoute guardrails protect sensitive data with PII masking and credential redaction. Learn how this framework scans payloads and replaces sensitive info.

- Repository: [Diego Rodrigues de Sa e Souza/OmniRoute](https://github.com/diegosouzapw/OmniRoute)
- Tags: how-to-guide
- Published: 2026-08-06

---

**OmniRoute protects sensitive data through a dedicated guardrails framework that uses feature flags to opt‑in PII masking and credential redaction, scanning request/response payloads and replacing detected values with `[REDACTED]` placeholders.**

The OmniRoute proxy implements a **guardrails system** for sanitizing traffic between clients and LLM providers. Two specialized guardrails—`PIIMaskerGuardrail` and `CredentialMaskerGuardrail`—operate on request and response payloads to ensure **personally identifiable information (PII)** and **credentials** never leave the server unredacted. This article explains how each guardrail works, where it hooks into the request pipeline, and how operators configure the behavior.

## How the Guardrail Pipeline Works

All guardrails in OmniRoute extend `BaseGuardrail` defined in [`src/lib/guardrails/base.ts`](https://github.com/diegosouzapw/OmniRoute/blob/main/src/lib/guardrails/base.ts). The base class establishes a `preCall`/`postCall` contract:

- **`preCall`** runs before the request reaches the provider
- **`postCall`** runs after the provider returns a response

The [`src/lib/guardrails/registry.ts`](https://github.com/diegosouzapw/OmniRoute/blob/main/src/lib/guardrails/registry.ts) file registers active guardrails, and the request pipeline automatically invokes them. Both the PII and credential maskers are **non‑blocking**—they always allow the request through, only modifying payloads in‑place.

## PII Masking Guardrail

The `PIIMaskerGuardrail` in [`src/lib/guardrails/piiMasker.ts`](https://github.com/diegosouzapw/OmniRoute/blob/main/src/lib/guardrails/piiMasker.ts) handles detection and redaction of personally identifiable information.

### Feature Flag Activation

PII masking is **opt‑in** via the `PII_REDACTION_ENABLED` flag. The guardrail checks this flag through `isRequestPiiMaskingEnabled()`, which delegates to `isFeatureFlagEnabled` in [`src/shared/utils/featureFlags.ts`](https://github.com/diegosouzapw/OmniRoute/blob/main/src/shared/utils/featureFlags.ts). Flag resolution follows the hierarchy **database → environment → default**.

```typescript
// Check if PII masking is enabled
const enabled = await isRequestPiiMaskingEnabled(); // checks PII_REDACTION_ENABLED

```

### Request‑Side Masking

Before dispatch, `cloneAndMaskRequestPayload()` clones the payload and walks fields containing free‑form text: `system`, `messages`, `input`, `prompt`, and similar. Each string runs through `sanitizeStringValue()`, which calls `processPII` from [`src/shared/utils/inputSanitizer.ts`](https://github.com/diegosouzapw/OmniRoute/blob/main/src/shared/utils/inputSanitizer.ts).

```typescript
// Example: payload before masking
const payload = {
  system: "User email: alice@example.com",
  messages: [{ 
    role: "user", 
    content: "My credit card is 4111-1111-1111-1111" 
  }],
};

// After PIIMaskerGuardrail.preCall()
const { modifiedPayload } = await new PIIMaskerGuardrail().preCall(payload, ctx);
// Emails and credit card numbers replaced with [REDACTED]

```

The `processPII` function detects:

- Email addresses
- Credit card numbers
- CPF (Brazilian tax ID)
- Other common PII patterns

Detected values are replaced with `[REDACTED]`. The guardrail also records detection counts for telemetry.

### Response‑Side Masking

After the provider responds, `maskResponsesOutput()` processes fields like `output_text` and `output[].content[].text`. It uses `sanitizePII` and `sanitizePIIResponse` from [`src/lib/piiSanitizer.ts`](https://github.com/diegosouzapw/OmniRoute/blob/main/src/lib/piiSanitizer.ts) to rewrite only PII‑containing segments.

## Credential Redaction Guardrail

The `CredentialMaskerGuardrail` in [`src/lib/guardrails/credentialMasker.ts`](https://github.com/diegosouzapw/OmniRoute/blob/main/src/lib/guardrails/credentialMasker.ts) follows the same architectural pattern but targets secrets rather than personal data.

### Feature Flag Activation

Credential redaction requires `CREDENTIAL_REDACTION_ENABLED`. Like PII masking, this resolves through the same flag hierarchy in [`src/shared/utils/featureFlags.ts`](https://github.com/diegosouzapw/OmniRoute/blob/main/src/shared/utils/featureFlags.ts).

```typescript
// Enable via environment
process.env.CREDENTIAL_REDACTION_ENABLED = "true";

```

### Pattern‑Based Secret Detection

The `sanitizeCredentials()` function applies regex patterns matching common secret formats:

- Long hexadecimal strings (API keys)
- JSON Web Tokens (JWTs)
- Bearer tokens and other authentication credentials

```typescript
// Example log line before redaction
const logLine = "Calling OpenAI with API key sk-abcd1234efgh5678ijkl90mn";

// After CredentialMaskerGuardrail.preCall()
const { modifiedPayload: safeLog } = await new CredentialMaskerGuardrail().preCall(
  { message: logLine },
  ctx
);
// Result: "Calling OpenAI with API key [REDACTED]"

```

The credential guardrail sanitizes **request payloads**, **log messages**, and **response bodies** before persistence or forwarding.

## Key Implementation Files

| File | Purpose |
|------|---------|
| [`src/lib/guardrails/base.ts`](https://github.com/diegosouzapw/OmniRoute/blob/main/src/lib/guardrails/base.ts) | Abstract `BaseGuardrail` class defining `preCall`/`postCall` interface |
| [`src/lib/guardrails/piiMasker.ts`](https://github.com/diegosouzapw/OmniRoute/blob/main/src/lib/guardrails/piiMasker.ts) | `PIIMaskerGuardrail` with `cloneAndMaskRequestPayload()`, `maskResponsesOutput()` |
| [`src/lib/guardrails/credentialMasker.ts`](https://github.com/diegosouzapw/OmniRoute/blob/main/src/lib/guardrails/credentialMasker.ts) | `CredentialMaskerGuardrail` with `sanitizeCredentials()` |
| [`src/lib/guardrails/registry.ts`](https://github.com/diegosouzapw/OmniRoute/blob/main/src/lib/guardrails/registry.ts) | Guardrail registration and pipeline integration |
| [`src/shared/utils/inputSanitizer.ts`](https://github.com/diegosouzapw/OmniRoute/blob/main/src/shared/utils/inputSanitizer.ts) | Core `processPII` detection logic |
| [`src/lib/piiSanitizer.ts`](https://github.com/diegosouzapw/OmniRoute/blob/main/src/lib/piiSanitizer.ts) | Response‑side `sanitizePII`, `sanitizePIIResponse` |
| [`src/shared/utils/featureFlags.ts`](https://github.com/diegosouzapw/OmniRoute/blob/main/src/shared/utils/featureFlags.ts) | `isFeatureFlagEnabled` for flag resolution |

## Configuration Examples

Enable both guardrails for maximum protection:

```typescript
// Environment-based configuration
process.env.PII_REDACTION_ENABLED = "true";
process.env.CREDENTIAL_REDACTION_ENABLED = "true";

// Or via database override (takes precedence)
// INSERT INTO feature_flags (key, value) VALUES 
//   ('PII_REDACTION_ENABLED', 'true'),
//   ('CREDENTIAL_REDACTION_ENABLED', 'true');

```

The database override allows per‑deployment toggling without code changes or restarts.

## Summary

- **PII masking** and **credential redaction** are implemented as separate guardrails extending `BaseGuardrail`
- Both features are **opt‑in** via `PII_REDACTION_ENABLED` and `CREDENTIAL_REDACTION_ENABLED` flags
- The **DB → environment → default** hierarchy allows flexible per‑deployment configuration
- **Request payloads** are cloned and sanitized in `preCall`; **responses** are processed in `postCall`
- Detected sensitive values are replaced with `[REDACTED]` placeholders
- Detection counts are captured for telemetry without blocking requests

## Frequently Asked Questions

### What PII patterns does OmniRoute detect?

OmniRoute detects email addresses, credit card numbers, CPF (Brazilian tax ID), and other common PII formats through `processPII` in [`src/shared/utils/inputSanitizer.ts`](https://github.com/diegosouzapw/OmniRoute/blob/main/src/shared/utils/inputSanitizer.ts). The detection is regex‑based and runs on any string field in request/response payloads.

### Can credential redaction catch custom API key formats?

The `sanitizeCredentials()` function in [`src/lib/guardrails/credentialMasker.ts`](https://github.com/diegosouzapw/OmniRoute/blob/main/src/lib/guardrails/credentialMasker.ts) uses pattern matching for standard secret formats like hex strings and JWTs. Operators needing custom patterns would need to extend the regex definitions in that file; there is no runtime configuration for custom patterns in the current implementation.

### Do these guardrails ever block requests?

No. Both `PIIMaskerGuardrail` and `CredentialMaskerGuardrail` are **non‑blocking** by design. They modify payloads in‑place through `preCall` and `postCall` hooks but always return the modified result for pipeline continuation. Blocking behavior would require a separate guardrail implementation with different return semantics.

### How do I verify that PII masking is actually active?

Check the resolved flag value through `isRequestPiiMaskingEnabled()` and monitor telemetry counters. The guardrails record detection counts when PII or credentials are found and redacted. You can also inspect `modifiedPayload` in `preCall`/`postCall` results to verify `[REDACTED]` replacements.