How OmniRoute Guardrails Handle PII Masking and Credential Redaction

OmniRoute protects sensitive data through a dedicated guardrails framework that uses feature flags to opt‑in PII masking and credential redaction, scanning request/response payloads and replacing detected values with [REDACTED] placeholders.

The OmniRoute proxy implements a guardrails system for sanitizing traffic between clients and LLM providers. Two specialized guardrails—PIIMaskerGuardrail and CredentialMaskerGuardrail—operate on request and response payloads to ensure personally identifiable information (PII) and credentials never leave the server unredacted. This article explains how each guardrail works, where it hooks into the request pipeline, and how operators configure the behavior.

How the Guardrail Pipeline Works

All guardrails in OmniRoute extend BaseGuardrail defined in src/lib/guardrails/base.ts. The base class establishes a preCall/postCall contract:

• preCall runs before the request reaches the provider
• postCall runs after the provider returns a response

The src/lib/guardrails/registry.ts file registers active guardrails, and the request pipeline automatically invokes them. Both the PII and credential maskers are non‑blocking—they always allow the request through, only modifying payloads in‑place.

PII Masking Guardrail

The PIIMaskerGuardrail in src/lib/guardrails/piiMasker.ts handles detection and redaction of personally identifiable information.

Feature Flag Activation

PII masking is opt‑in via the PII_REDACTION_ENABLED flag. The guardrail checks this flag through isRequestPiiMaskingEnabled(), which delegates to isFeatureFlagEnabled in src/shared/utils/featureFlags.ts. Flag resolution follows the hierarchy database → environment → default.

// Check if PII masking is enabled
const enabled = await isRequestPiiMaskingEnabled(); // checks PII_REDACTION_ENABLED

Request‑Side Masking

Before dispatch, cloneAndMaskRequestPayload() clones the payload and walks fields containing free‑form text: system, messages, input, prompt, and similar. Each string runs through sanitizeStringValue(), which calls processPII from src/shared/utils/inputSanitizer.ts.

// Example: payload before masking
const payload = {
  system: "User email: alice@example.com",
  messages: [{ 
    role: "user", 
    content: "My credit card is 4111-1111-1111-1111" 
  }],
};

// After PIIMaskerGuardrail.preCall()
const { modifiedPayload } = await new PIIMaskerGuardrail().preCall(payload, ctx);
// Emails and credit card numbers replaced with [REDACTED]

The processPII function detects:

• Email addresses
• Credit card numbers
• CPF (Brazilian tax ID)
• Other common PII patterns

Detected values are replaced with [REDACTED]. The guardrail also records detection counts for telemetry.

Response‑Side Masking

After the provider responds, maskResponsesOutput() processes fields like output_text and output[].content[].text. It uses sanitizePII and sanitizePIIResponse from src/lib/piiSanitizer.ts to rewrite only PII‑containing segments.

Credential Redaction Guardrail

The CredentialMaskerGuardrail in src/lib/guardrails/credentialMasker.ts follows the same architectural pattern but targets secrets rather than personal data.

Feature Flag Activation

Credential redaction requires CREDENTIAL_REDACTION_ENABLED. Like PII masking, this resolves through the same flag hierarchy in src/shared/utils/featureFlags.ts.

// Enable via environment
process.env.CREDENTIAL_REDACTION_ENABLED = "true";

Pattern‑Based Secret Detection

The sanitizeCredentials() function applies regex patterns matching common secret formats:

• Long hexadecimal strings (API keys)
• JSON Web Tokens (JWTs)
• Bearer tokens and other authentication credentials

// Example log line before redaction
const logLine = "Calling OpenAI with API key sk-abcd1234efgh5678ijkl90mn";

// After CredentialMaskerGuardrail.preCall()
const { modifiedPayload: safeLog } = await new CredentialMaskerGuardrail().preCall(
  { message: logLine },
  ctx
);
// Result: "Calling OpenAI with API key [REDACTED]"

The credential guardrail sanitizes request payloads, log messages, and response bodies before persistence or forwarding.

Key Implementation Files

File	Purpose
src/lib/guardrails/base.ts	Abstract BaseGuardrail class defining preCall/postCall interface
src/lib/guardrails/piiMasker.ts	PIIMaskerGuardrail with cloneAndMaskRequestPayload(), maskResponsesOutput()
src/lib/guardrails/credentialMasker.ts	CredentialMaskerGuardrail with sanitizeCredentials()
src/lib/guardrails/registry.ts	Guardrail registration and pipeline integration
src/shared/utils/inputSanitizer.ts	Core processPII detection logic
src/lib/piiSanitizer.ts	Response‑side sanitizePII, sanitizePIIResponse
src/shared/utils/featureFlags.ts	isFeatureFlagEnabled for flag resolution

Configuration Examples

Enable both guardrails for maximum protection:

// Environment-based configuration
process.env.PII_REDACTION_ENABLED = "true";
process.env.CREDENTIAL_REDACTION_ENABLED = "true";

// Or via database override (takes precedence)
// INSERT INTO feature_flags (key, value) VALUES 
//   ('PII_REDACTION_ENABLED', 'true'),
//   ('CREDENTIAL_REDACTION_ENABLED', 'true');

The database override allows per‑deployment toggling without code changes or restarts.

Summary

• PII masking and credential redaction are implemented as separate guardrails extending BaseGuardrail
• Both features are opt‑in via PII_REDACTION_ENABLED and CREDENTIAL_REDACTION_ENABLED flags
• The DB → environment → default hierarchy allows flexible per‑deployment configuration
• Request payloads are cloned and sanitized in preCall; responses are processed in postCall
• Detected sensitive values are replaced with [REDACTED] placeholders
• Detection counts are captured for telemetry without blocking requests

Frequently Asked Questions

What PII patterns does OmniRoute detect?

OmniRoute detects email addresses, credit card numbers, CPF (Brazilian tax ID), and other common PII formats through processPII in src/shared/utils/inputSanitizer.ts. The detection is regex‑based and runs on any string field in request/response payloads.

Can credential redaction catch custom API key formats?

The sanitizeCredentials() function in src/lib/guardrails/credentialMasker.ts uses pattern matching for standard secret formats like hex strings and JWTs. Operators needing custom patterns would need to extend the regex definitions in that file; there is no runtime configuration for custom patterns in the current implementation.

Do these guardrails ever block requests?

No. Both PIIMaskerGuardrail and CredentialMaskerGuardrail are non‑blocking by design. They modify payloads in‑place through preCall and postCall hooks but always return the modified result for pipeline continuation. Blocking behavior would require a separate guardrail implementation with different return semantics.

How do I verify that PII masking is actually active?

Check the resolved flag value through isRequestPiiMaskingEnabled() and monitor telemetry counters. The guardrails record detection counts when PII or credentials are found and redacted. You can also inspect modifiedPayload in preCall/postCall results to verify [REDACTED] replacements.

{
  "mcpServers": {
    "instagit": {
      "command": "npx",
      "args": ["-y", "instagit@latest"]
    }
  }
}