# OmniRoute PII Redaction and Prompt Injection Protection: A Complete Guide to Built-In Guardrails

> Discover OmniRoute's built-in guardrails for PII redaction and prompt injection protection. Learn how to configure these essential security features to safeguard your data and applications.

- Repository: [Diego Rodrigues de Sa e Souza/OmniRoute](https://github.com/diegosouzapw/OmniRoute)
- Tags: how-to-guide
- Published: 2026-08-19

---

**OmniRoute provides dedicated PII redaction and prompt injection guardrails that run on every request, configurable via feature flags to either sanitize content or block malicious attempts entirely.**

OmniRoute implements **defense-in-depth security** through two specialized guardrails designed to protect sensitive data and prevent adversarial LLM attacks. These guardrails are integrated directly into the request pipeline of the [diegosouzapw/OmniRoute](https://github.com/diegosouzapw/OmniRoute) routing layer, ensuring protection before any data reaches downstream providers.

## How OmniRoute PII Redaction Works

The **PII-Masker Guardrail** automatically identifies and removes personally identifiable information from both inbound requests and outbound responses.

### Activation and Configuration

PII redaction is **opt-in via feature flag**. The system checks `PII_REDACTION_ENABLED` (or its database override) before invoking any sanitization logic.

```bash

# .env configuration

PII_REDACTION_ENABLED=true
PII_RESPONSE_SANITIZATION_MODE=redact  # "redact" (default) or "block"

```

When enabled, the request payload flows through `processPII` in [`src/shared/utils/inputSanitizer.ts`](https://github.com/diegosouzapw/OmniRoute/blob/main/src/shared/utils/inputSanitizer.ts). This utility detects and replaces:

- Email addresses
- CPF numbers (Brazilian tax ID)
- Credit card numbers
- IP addresses
- Additional PII patterns defined in the sanitizer

### Streaming Response Protection

For **server-sent events (SSE)** and streaming responses, OmniRoute applies a **sliding-window sanitizer** to handle PII that spans chunk boundaries.

In [`src/lib/streamingPiiTransform.ts`](https://github.com/diegosouzapw/OmniRoute/blob/main/src/lib/streamingPiiTransform.ts), the `createPiiSseTransform()` function creates a transform stream that wraps [`src/lib/piiSanitizer.ts`](https://github.com/diegosouzapw/OmniRoute/blob/main/src/lib/piiSanitizer.ts). This ensures redaction occurs even when sensitive data is split across multiple response chunks.

```ts
import { createPiiSseTransform } from '@/lib/streamingPiiTransform';

const transform = createPiiSseTransform();
await executor.execute(stream => {
  stream.pipe(transform).pipe(res);
});

```

### Operational Modes

| Mode | Behavior | Use Case |
|------|----------|----------|
| **Redact** (default) | Replaces PII with placeholders, forwards request | Standard production deployments |
| **Block** | Rejects request containing PII | High-security environments (future policy) |

The default **redact mode** ensures business continuity while preventing data leakage. The **block mode** remains available for future policy implementations but is not active by default.

## OmniRoute Prompt Injection Protection Explained

The **Prompt-Injection Guardrail** detects adversarial patterns designed to manipulate LLM behavior or extract system prompts.

### Detection Architecture

Core detection logic resides in [`src/lib/guardrails/promptInjection.ts`](https://github.com/diegosouzapw/OmniRoute/blob/main/src/lib/guardrails/promptInjection.ts). The system scans combined user and system messages against a curated **regular-expression catalog** defined in [`src/shared/utils/injectionSeverity.ts`](https://github.com/diegosouzapw/OmniRoute/blob/main/src/shared/utils/injectionSeverity.ts).

Detected patterns include:

- `delimiter_injection` — attempts to break message boundaries
- `system_prompt_leak` — prompts designed to expose system instructions
- Custom "injection" tokens identified in the severity registry

### Configuration: Warn vs. Block Modes

The `INJECTION_GUARD_MODE` environment variable controls guardrail behavior:

```bash

# .env configuration

INJECTION_GUARD_MODE=warn   # Log and annotate (default)

INJECTION_GUARD_MODE=block  # Reject request with 400 error

```

**Warn mode** (default) attaches detection metadata to responses without interrupting service. **Block mode** halts execution and returns `injection_detected` error.

### Manual Guardrail Invocation

For custom implementations, import the evaluation function directly:

```ts
import { evaluatePromptInjection } from '@/lib/guardrails/promptInjection';

const decision = evaluatePromptInjection(messages, { mode: 'warn' });

if (decision.blocked) {
  return new Response('Injection detected', { status: 400 });
}

response.metadata = { ...response.metadata, guardrails: decision };

```

## Guardrail Integration in the Request Pipeline

Both guardrails are **registered centrally** and **executed early** in request processing.

### Central Registry

[`src/lib/guardrails/registry.ts`](https://github.com/diegosouzapw/OmniRoute/blob/main/src/lib/guardrails/registry.ts) instantiates all guardrails at application startup:

- `PIIMaskerGuardrail` class (implementation in [`src/lib/guardrails/piiMasker.ts`](https://github.com/diegosouzapw/OmniRoute/blob/main/src/lib/guardrails/piiMasker.ts))
- Prompt-injection detector

### Middleware Integration

The injection guardrail plugs into Express/Fastify middleware via [`src/middleware/promptInjectionGuard.ts`](https://github.com/diegosouzapw/OmniRoute/blob/main/src/middleware/promptInjectionGuard.ts). Request sanitization occurs through the shared `sanitizeRequest` utility:

```ts
import { sanitizeRequest } from '@/shared/utils/inputSanitizer';

export async function POST(req: Request) {
  const body = await req.json();
  const { sanitizedBody, detections } = await sanitizeRequest(body);
  // `detections` contains redacted elements for audit logging
}

```

### Metadata and Logging

Guardrail decisions are **logged through the standard guardrail logger** and attached to response metadata under the `guardrails` key. This enables:

- Audit trail compliance
- Alerting on injection attempts
- Visibility into PII detection rates

## Key Implementation Files

| File Path | Purpose |
|-----------|---------|
| [`src/lib/guardrails/piiMasker.ts`](https://github.com/diegosouzapw/OmniRoute/blob/main/src/lib/guardrails/piiMasker.ts) | `PIIMaskerGuardrail` class implementation |
| [`src/lib/guardrails/promptInjection.ts`](https://github.com/diegosouzapw/OmniRoute/blob/main/src/lib/guardrails/promptInjection.ts) | Core injection detection and decision logic |
| [`src/lib/guardrails/registry.ts`](https://github.com/diegosouzapw/OmniRoute/blob/main/src/lib/guardrails/registry.ts) | Central guardrail instantiation and registration |
| [`src/shared/utils/inputSanitizer.ts`](https://github.com/diegosouzapw/OmniRoute/blob/main/src/shared/utils/inputSanitizer.ts) | `processPII`, `sanitizeRequest`, and shared utilities |
| [`src/lib/piiSanitizer.ts`](https://github.com/diegosouzapw/OmniRoute/blob/main/src/lib/piiSanitizer.ts) | Streaming-compatible PII redaction engine |
| [`src/lib/streamingPiiTransform.ts`](https://github.com/diegosouzapw/OmniRoute/blob/main/src/lib/streamingPiiTransform.ts) | SSE transform applying sliding-window sanitization |
| [`src/middleware/promptInjectionGuard.ts`](https://github.com/diegosouzapw/OmniRoute/blob/main/src/middleware/promptInjectionGuard.ts) | Middleware binding injection detection to HTTP pipeline |

## Summary

- **PII redaction** is opt-in via `PII_REDACTION_ENABLED`, operating in redact mode by default with streaming-safe chunk boundary handling.
- **Prompt injection protection** uses regex-based pattern matching with configurable warn/block responses via `INJECTION_GUARD_MODE`.
- Both guardrails execute **before provider invocation**, ensuring malicious or sensitive content never reaches downstream LLMs.
- **Metadata logging** provides audit trails and operational visibility without impacting latency-critical paths.
- The modular architecture allows **programmatic access** to sanitization utilities for custom middleware or external integrations.

## Frequently Asked Questions

### How do I enable PII redaction in OmniRoute?

Set `PII_REDACTION_ENABLED=true` in your environment variables or database configuration. The guardrail activates automatically on the next request. No code changes are required—the middleware layer handles invocation transparently.

### Can OmniRoute block requests containing PII instead of redacting them?

The codebase includes a **block mode** placeholder via `PII_RESPONSE_SANITIZATION_MODE`, but the default and recommended configuration uses **redact mode**. Block mode for PII requires additional policy configuration that is not enabled by default in release v3.8.50.

### What happens to PII that spans multiple streaming chunks?

The [`src/lib/streamingPiiTransform.ts`](https://github.com/diegosouzapw/OmniRoute/blob/main/src/lib/streamingPiiTransform.ts) implementation maintains a **sliding window buffer** that aggregates chunks across boundaries before applying `sanitizePIIChunk` from [`src/lib/piiSanitizer.ts`](https://github.com/diegosouzapw/OmniRoute/blob/main/src/lib/piiSanitizer.ts). This prevents split PII (e.g., an email address divided across two SSE events) from leaking.

### How does prompt injection detection differ from PII redaction?

**PII redaction** uses pattern matching to identify and replace sensitive data structures (emails, credit cards). **Prompt injection detection** analyzes semantic attack patterns using severity-scored regexes to identify adversarial intent. Injection detection operates on message content and intent; PII detection operates on data classification regardless of context.

### Where are guardrail decisions logged and how can I access them?

Decisions are emitted through OmniRoute's **standard guardrail logger** and appended to response metadata under `response.metadata.guardrails`. This structure contains detection type, severity, action taken (warn/block), and matched patterns for both PII and injection events.