OmniRoute Guardrails for Prompt Injection and PII Protection: A Technical Deep Dive

OmniRoute hard-codes two complementary guardrail systems that automatically protect every request and response from malicious prompt injection and accidental leakage of personally identifiable information (PII).

The diegosouzapw/OmniRoute repository provides an open-source routing layer for LLM applications that ships with deterministic, regex-based OmniRoute guardrails for prompt injection and PII protection built directly into the request pipeline. Unlike external API-based safety services, these protections execute locally within the middleware stack, examining payloads and responses before they reach the upstream language model or return to the client.

Prompt Injection Protection Architecture

OmniRoute treats prompt injection as a critical path security concern, implementing a mandatory middleware that wraps every public API endpoint.

The Injection Guard Middleware

The system intercepts all incoming traffic through src/middleware/promptInjectionGuard.ts, which exports createInjectionGuard and withInjectionGuard wrappers used by chat, completions, embeddings, images, and video routes. This middleware instantiates an InjectionGuard object that coordinates validation logic.

// src/app/api/v1/chat/completions/route.ts
import { createInjectionGuard } from "@/middleware/promptInjectionGuard";

export const POST = createInjectionGuard(async (req) => {
  // …normal handler logic…
});

Core Guardrail Implementation

The actual detection logic resides in src/lib/guardrails/promptInjection.ts within the PromptInjectionGuardrail class. This module analyzes incoming payloads for injection patterns that attempt to override system behavior, such as "system-prompt", "assistant-prompt", and "user-prompt" injection sequences.

Severity Classification and Response

Detection rules are centralized in src/shared/utils/injectionSeverity.ts, which defines severity levels that determine the guardrail's response:

• High severity: Returns HTTP 400 error and rejects the request
• Medium severity: Sanitizes the prompt to neutralize injection attempts
• Low severity: Logs a warning while allowing the request to proceed

PII Protection Architecture

While prompt injection protection is mandatory, OmniRoute's PII guardrails are opt-in via environment-based feature flags that control two distinct processing stages.

Request-Side PII Masking

When PII_REDACTION_ENABLED is set to "true", the PII-Masker guard (src/lib/guardrails/piiMasker.ts) executes on incoming requests. This component uses regex-based bounded patterns to detect and mask personally identifiable information before the prompt reaches the LLM provider.

Configuration is managed through src/lib/config/runtimeSettings.ts:

// src/lib/config/runtimeSettings.ts
export const runtimeSettings = {
  PII_REDACTION_ENABLED: process.env.PII_REDACTION_ENABLED ?? "false",
  PII_RESPONSE_SANITIZATION: process.env.PII_RESPONSE_SANITIZATION ?? "false",
};

Response-Side PII Sanitization

To prevent accidental PII leakage in generated content, the PII-Sanitizer in src/lib/piiSanitizer.ts processes outgoing responses when PII_RESPONSE_SANITIZATION is enabled. This ensures that even if the LLM generates sensitive information, it is redacted before reaching the end user:

import { sanitizeResponse } from "@/lib/piiSanitizer";

const safeBody = sanitizeResponse(llmResponse);
return new Response(JSON.stringify(safeBody));

Guardrail Registry Integration

Both PII components integrate with the central Guardrail Registry at src/lib/guardrails/registry.ts, which orchestrates the execution order of all safety checks within the request lifecycle.

Key Implementation Files

• src/middleware/promptInjectionGuard.ts – Middleware factory that injects protection into public endpoints
• src/lib/guardrails/promptInjection.ts – Core detection engine for injection patterns
• src/shared/utils/injectionSeverity.ts – Severity level definitions and matching rules
• src/lib/guardrails/piiMasker.ts – Request-side PII detection and masking (opt-in)
• src/lib/piiSanitizer.ts – Response-side PII redaction (opt-in)
• src/lib/guardrails/registry.ts – Central coordination hub for all guardrail modules

Summary

• Mandatory prompt injection protection wraps every API endpoint via createInjectionGuard, analyzing payloads for system prompt overrides and rejecting or sanitizing malicious requests based on severity levels defined in injectionSeverity.ts.
• Opt-in PII protection requires explicit activation via PII_REDACTION_ENABLED and PII_RESPONSE_SANITIZATION environment variables, utilizing piiMasker.ts for inbound requests and piiSanitizer.ts for outbound responses.
• Both systems use deterministic, regex-based detection rather than probabilistic models, ensuring consistent performance and predictable latency characteristics.
• The Guardrail Registry (registry.ts) provides a unified integration point that wires all safety checks into the request pipeline without modifying individual route handlers.

Frequently Asked Questions

Is prompt injection protection always enabled in OmniRoute?

Yes. According to the source code, the prompt injection guardrail is mandatory and automatically applied to all public API endpoints through the promptInjectionGuard.ts middleware. Routes for chat, completions, embeddings, and media generation all import either withInjectionGuard or createInjectionGuard to enforce this protection.

How do I enable PII protection in OmniRoute?

Set the environment variables PII_REDACTION_ENABLED and PII_RESPONSE_SANITIZATION to "true" in your deployment configuration. The system reads these flags at runtime via src/lib/config/runtimeSettings.ts, activating the PII-Masker for incoming requests and the PII-Sanitizer for outgoing responses respectively.

What specific injection patterns does OmniRoute detect?

The guardrail specifically targets override attempts defined in src/shared/utils/injectionSeverity.ts, including patterns that match "system-prompt", "assistant-prompt", and "user-prompt" injection sequences designed to hijack the conversation context or override system instructions.

Can the regex patterns for PII detection be customized?

The source code indicates that both piiMasker.ts and piiSanitizer.ts use "regex-based, bounded patterns" for detection. While the analysis references these patterns as configurable through the guardrail registry system, specific customization would require modification of the detection logic within those modules or extension of the registry configuration.

{
  "mcpServers": {
    "instagit": {
      "command": "npx",
      "args": ["-y", "instagit@latest"]
    }
  }
}