# OmniRoute Guardrails for Prompt Injection and PII Protection: A Technical Deep Dive

> Explore OmniRoute's prompt injection and PII protection guardrails. Discover how this technical deep dive secures your requests and responses automatically.

- Repository: [Diego Rodrigues de Sa e Souza/OmniRoute](https://github.com/diegosouzapw/OmniRoute)
- Tags: deep-dive
- Published: 2026-08-24

---

**OmniRoute hard-codes two complementary guardrail systems that automatically protect every request and response from malicious prompt injection and accidental leakage of personally identifiable information (PII).**

The **diegosouzapw/OmniRoute** repository provides an open-source routing layer for LLM applications that ships with deterministic, regex-based **OmniRoute guardrails for prompt injection and PII** protection built directly into the request pipeline. Unlike external API-based safety services, these protections execute locally within the middleware stack, examining payloads and responses before they reach the upstream language model or return to the client.

## Prompt Injection Protection Architecture

OmniRoute treats prompt injection as a critical path security concern, implementing a mandatory middleware that wraps every public API endpoint.

### The Injection Guard Middleware

The system intercepts all incoming traffic through [`src/middleware/promptInjectionGuard.ts`](https://github.com/diegosouzapw/OmniRoute/blob/main/src/middleware/promptInjectionGuard.ts), which exports `createInjectionGuard` and `withInjectionGuard` wrappers used by chat, completions, embeddings, images, and video routes. This middleware instantiates an `InjectionGuard` object that coordinates validation logic.

```typescript
// src/app/api/v1/chat/completions/route.ts
import { createInjectionGuard } from "@/middleware/promptInjectionGuard";

export const POST = createInjectionGuard(async (req) => {
  // …normal handler logic…
});

```

### Core Guardrail Implementation

The actual detection logic resides in [`src/lib/guardrails/promptInjection.ts`](https://github.com/diegosouzapw/OmniRoute/blob/main/src/lib/guardrails/promptInjection.ts) within the **PromptInjectionGuardrail** class. This module analyzes incoming payloads for injection patterns that attempt to override system behavior, such as "system-prompt", "assistant-prompt", and "user-prompt" injection sequences.

### Severity Classification and Response

Detection rules are centralized in [`src/shared/utils/injectionSeverity.ts`](https://github.com/diegosouzapw/OmniRoute/blob/main/src/shared/utils/injectionSeverity.ts), which defines severity levels that determine the guardrail's response:

- **High severity**: Returns HTTP `400` error and rejects the request
- **Medium severity**: Sanitizes the prompt to neutralize injection attempts
- **Low severity**: Logs a warning while allowing the request to proceed

## PII Protection Architecture

While prompt injection protection is mandatory, OmniRoute's PII guardrails are **opt-in** via environment-based feature flags that control two distinct processing stages.

### Request-Side PII Masking

When `PII_REDACTION_ENABLED` is set to `"true"`, the **PII-Masker** guard ([`src/lib/guardrails/piiMasker.ts`](https://github.com/diegosouzapw/OmniRoute/blob/main/src/lib/guardrails/piiMasker.ts)) executes on incoming requests. This component uses regex-based bounded patterns to detect and mask personally identifiable information before the prompt reaches the LLM provider.

Configuration is managed through [`src/lib/config/runtimeSettings.ts`](https://github.com/diegosouzapw/OmniRoute/blob/main/src/lib/config/runtimeSettings.ts):

```typescript
// src/lib/config/runtimeSettings.ts
export const runtimeSettings = {
  PII_REDACTION_ENABLED: process.env.PII_REDACTION_ENABLED ?? "false",
  PII_RESPONSE_SANITIZATION: process.env.PII_RESPONSE_SANITIZATION ?? "false",
};

```

### Response-Side PII Sanitization

To prevent accidental PII leakage in generated content, the **PII-Sanitizer** in [`src/lib/piiSanitizer.ts`](https://github.com/diegosouzapw/OmniRoute/blob/main/src/lib/piiSanitizer.ts) processes outgoing responses when `PII_RESPONSE_SANITIZATION` is enabled. This ensures that even if the LLM generates sensitive information, it is redacted before reaching the end user:

```typescript
import { sanitizeResponse } from "@/lib/piiSanitizer";

const safeBody = sanitizeResponse(llmResponse);
return new Response(JSON.stringify(safeBody));

```

### Guardrail Registry Integration

Both PII components integrate with the central **Guardrail Registry** at [`src/lib/guardrails/registry.ts`](https://github.com/diegosouzapw/OmniRoute/blob/main/src/lib/guardrails/registry.ts), which orchestrates the execution order of all safety checks within the request lifecycle.

## Key Implementation Files

- **[`src/middleware/promptInjectionGuard.ts`](https://github.com/diegosouzapw/OmniRoute/blob/main/src/middleware/promptInjectionGuard.ts)** – Middleware factory that injects protection into public endpoints
- **[`src/lib/guardrails/promptInjection.ts`](https://github.com/diegosouzapw/OmniRoute/blob/main/src/lib/guardrails/promptInjection.ts)** – Core detection engine for injection patterns
- **[`src/shared/utils/injectionSeverity.ts`](https://github.com/diegosouzapw/OmniRoute/blob/main/src/shared/utils/injectionSeverity.ts)** – Severity level definitions and matching rules
- **[`src/lib/guardrails/piiMasker.ts`](https://github.com/diegosouzapw/OmniRoute/blob/main/src/lib/guardrails/piiMasker.ts)** – Request-side PII detection and masking (opt-in)
- **[`src/lib/piiSanitizer.ts`](https://github.com/diegosouzapw/OmniRoute/blob/main/src/lib/piiSanitizer.ts)** – Response-side PII redaction (opt-in)
- **[`src/lib/guardrails/registry.ts`](https://github.com/diegosouzapw/OmniRoute/blob/main/src/lib/guardrails/registry.ts)** – Central coordination hub for all guardrail modules

## Summary

- **Mandatory prompt injection protection** wraps every API endpoint via `createInjectionGuard`, analyzing payloads for system prompt overrides and rejecting or sanitizing malicious requests based on severity levels defined in [`injectionSeverity.ts`](https://github.com/diegosouzapw/OmniRoute/blob/main/injectionSeverity.ts).
- **Opt-in PII protection** requires explicit activation via `PII_REDACTION_ENABLED` and `PII_RESPONSE_SANITIZATION` environment variables, utilizing [`piiMasker.ts`](https://github.com/diegosouzapw/OmniRoute/blob/main/piiMasker.ts) for inbound requests and [`piiSanitizer.ts`](https://github.com/diegosouzapw/OmniRoute/blob/main/piiSanitizer.ts) for outbound responses.
- Both systems use deterministic, regex-based detection rather than probabilistic models, ensuring consistent performance and predictable latency characteristics.
- The **Guardrail Registry** ([`registry.ts`](https://github.com/diegosouzapw/OmniRoute/blob/main/registry.ts)) provides a unified integration point that wires all safety checks into the request pipeline without modifying individual route handlers.

## Frequently Asked Questions

### Is prompt injection protection always enabled in OmniRoute?

Yes. According to the source code, the prompt injection guardrail is mandatory and automatically applied to all public API endpoints through the [`promptInjectionGuard.ts`](https://github.com/diegosouzapw/OmniRoute/blob/main/promptInjectionGuard.ts) middleware. Routes for chat, completions, embeddings, and media generation all import either `withInjectionGuard` or `createInjectionGuard` to enforce this protection.

### How do I enable PII protection in OmniRoute?

Set the environment variables `PII_REDACTION_ENABLED` and `PII_RESPONSE_SANITIZATION` to `"true"` in your deployment configuration. The system reads these flags at runtime via [`src/lib/config/runtimeSettings.ts`](https://github.com/diegosouzapw/OmniRoute/blob/main/src/lib/config/runtimeSettings.ts), activating the PII-Masker for incoming requests and the PII-Sanitizer for outgoing responses respectively.

### What specific injection patterns does OmniRoute detect?

The guardrail specifically targets override attempts defined in [`src/shared/utils/injectionSeverity.ts`](https://github.com/diegosouzapw/OmniRoute/blob/main/src/shared/utils/injectionSeverity.ts), including patterns that match "system-prompt", "assistant-prompt", and "user-prompt" injection sequences designed to hijack the conversation context or override system instructions.

### Can the regex patterns for PII detection be customized?

The source code indicates that both [`piiMasker.ts`](https://github.com/diegosouzapw/OmniRoute/blob/main/piiMasker.ts) and [`piiSanitizer.ts`](https://github.com/diegosouzapw/OmniRoute/blob/main/piiSanitizer.ts) use "regex-based, bounded patterns" for detection. While the analysis references these patterns as configurable through the guardrail registry system, specific customization would require modification of the detection logic within those modules or extension of the registry configuration.