# OmniRoute Security Guardrails for PII Redaction and Credential Masking: A Technical Deep Dive

> Explore OmniRoute's security guardrails for automatic PII redaction and credential masking in requests, responses, logs, UI, and traffic. Protect sensitive data with OmniRoute.

- Repository: [Diego Rodrigues de Sa e Souza/OmniRoute](https://github.com/diegosouzapw/OmniRoute)
- Tags: deep-dive
- Published: 2026-08-10

---

**OmniRoute implements a layered guard-rail system that automatically redacts personally identifiable information (PII) in both incoming requests and outgoing provider responses while masking secret values like API keys and tokens in logs, UI displays, and intercepted traffic.**

OmniRoute (diegosouzapw/OmniRoute) is an open-source AI gateway that embeds comprehensive security guardrails to prevent sensitive data leakage. The framework provides configurable **PII redaction** and **credential masking** capabilities that operate at multiple layers of the request lifecycle, ensuring that sensitive identifiers never leave the server in clear text.

## Request-Side PII Redaction with PIIMaskerGuardrail

The `PIIMaskerGuardrail` class, registered in [`src/lib/guardrails/registry.ts`](https://github.com/diegosouzapw/OmniRoute/blob/main/src/lib/guardrails/registry.ts), intercepts and sanitizes incoming payloads before they reach AI providers. When the `PII_REDACTION_ENABLED` feature flag is active, the guardrail clones the request object and traverses every string field—including `messages`, `system` prompts, `input`, and `prompt` parameters—applying the `processPII` sanitizer (lines 14-22 in [`src/lib/guardrails/piiMasker.ts`](https://github.com/diegosouzapw/OmniRoute/blob/main/src/lib/guardrails/piiMasker.ts)). 

Detected PII entities are replaced with standardized placeholders, and the system increments a detection count for audit trails. This ensures that user-submitted social security numbers, email addresses, and phone numbers never transit to third-party model providers.

## Response-Side PII Sanitization

After provider responses return, the `maskResponsesOutput` function scans the `output_text` field and any items within the `output` array, invoking `sanitizePII` from [`src/lib/piiSanitizer.ts`](https://github.com/diegosouzapw/OmniRoute/blob/main/src/lib/piiSanitizer.ts) (lines 51-61 in [`piiMasker.ts`](https://github.com/diegosouzapw/OmniRoute/blob/main/piiMasker.ts)). The sanitizer applies a configurable set of regex patterns defined in `PII_PATTERNS` to identify sensitive data embedded in model outputs.

Operators control the enforcement behavior via `PII_RESPONSE_SANITIZATION_MODE`, which supports three distinct modes (lines 23-31 in [`src/lib/piiSanitizer.ts`](https://github.com/diegosouzapw/OmniRoute/blob/main/src/lib/piiSanitizer.ts)):

- **redact** – Removes detected PII and replaces it with placeholders
- **warn** – Logs detection events but preserves the original content
- **block** – Prevents the response from reaching the client entirely when PII is detected

## Credential and Secret Masking Across the Stack

### MITM Proxy Header Sanitization

When the MITM proxy records traffic for the Inspector UI, the `maskSecret` utility from [`src/mitm/maskSecrets.ts`](https://github.com/diegosouzapw/OmniRoute/blob/main/src/mitm/maskSecrets.ts) automatically replaces sensitive header values—including `authorization`, `cookie`, and `set-cookie`—with `[REDACTED]` placeholders (lines 2-12). The [`sanitizeHeaders.ts`](https://github.com/diegosouzapw/OmniRoute/blob/main/sanitizeHeaders.ts) wrapper applies this masking to both incoming and outgoing headers before storage (lines 3-13 in [`src/mitm/sanitizeHeaders.ts`](https://github.com/diegosouzapw/OmniRoute/blob/main/src/mitm/sanitizeHeaders.ts)), ensuring that bearer tokens and session identifiers remain protected in inspection logs.

### Log Payload Protection

All log entries pass through `sanitizePayloadPII` in [`src/lib/logPayloads.ts`](https://github.com/diegosouzapw/OmniRoute/blob/main/src/lib/logPayloads.ts) (lines 1-9), which internally calls `sanitizePII` to strip any residual PII that may have slipped into debug output or error traces. This prevents accidental exposure of sensitive data in centralized logging systems.

### UI Display Masking

For user interface elements, `maskApiKey` in [`src/lib/services/apiKey.ts`](https://github.com/diegosouzapw/OmniRoute/blob/main/src/lib/services/apiKey.ts) (lines 40-45) utilizes `maskSegment` from [`src/shared/utils/formatting.ts`](https://github.com/diegosouzapw/OmniRoute/blob/main/src/shared/utils/formatting.ts) to partially obscure API key identifiers—showing only the first and last few characters—while maintaining enough visibility for users to recognize the key. Similarly, `maskEmail` in [`src/shared/utils/maskEmail.ts`](https://github.com/diegosouzapw/OmniRoute/blob/main/src/shared/utils/maskEmail.ts) (lines 2-13) obscures the user portion and domain of email addresses unless the UI explicitly requests full visibility.

## Feature Flag Configuration

All guard-rails respect feature flags defined in [`src/shared/constants/featureFlagDefinitions.ts`](https://github.com/diegosouzapw/OmniRoute/blob/main/src/shared/constants/featureFlagDefinitions.ts). By default, both `PII_REDACTION_ENABLED` (request-side) and `PII_RESPONSE_SANITIZATION` (response-side) are set to `false` (lines 51-63). 

Operators enable protection via environment variables or database-stored configurations:

```bash

# Enable request-side PII redaction

PII_REDACTION_ENABLED=true

# Enable response sanitization with block mode

PII_RESPONSE_SANITIZATION=true
PII_RESPONSE_SANITIZATION_MODE=block

```

The system logs redaction events for compliance auditing, creating an immutable record of when sensitive data was detected and removed.

## Practical Implementation Examples

The following examples demonstrate how to manually invoke OmniRoute's sanitization utilities in custom middleware or plugins:

```typescript
// Example: manually redacting a request payload before sending it to a provider
import { cloneAndMaskRequestPayload } from "@/lib/guardrails/piiMasker";

const original = { messages: [{ role: "user", content: "My SSN is 123-45-6789" }] };
const { payload, modified, detections } = cloneAndMaskRequestPayload(original);
console.log(modified);        // true
console.log(payload.messages[0].content); // "My SSN is [REDACTED]"

```

```typescript
// Example: sanitizing a provider response before returning to the client
import { sanitizePIIResponse } from "@/lib/piiSanitizer";

const llmResponse = {
  output_text: "Contact me at alice@example.com",
};
const sanitized = sanitizePIIResponse(llmResponse);
console.log(sanitized.output_text); // "Contact me at [REDACTED]"

```

```typescript
// Example: masking a secret header in MITM inspection logs
import { maskSecret } from "@/mitm/maskSecrets";

const rawHeaders = { authorization: "Bearer abc123xyz" };
const safeHeaders = { authorization: maskSecret(rawHeaders.authorization) };
console.log(safeHeaders.authorization); // "[REDACTED]"

```

## Summary

- **Layered protection** – OmniRoute applies guard-rails at ingress, egress, and persistence layers to ensure PII never leaks through requests, responses, or logs.
- **Bidirectional sanitization** – The `PIIMaskerGuardrail` processes incoming payloads while `sanitizePIIResponse` handles provider outputs, creating comprehensive coverage.
- **Credential masking** – Secrets in headers (`maskSecret`), logs (`sanitizePayloadPII`), and UI displays (`maskApiKey`, `maskEmail`) are automatically redacted using consistent `[REDACTED]` patterns.
- **Configurable enforcement** – Feature flags (`PII_REDACTION_ENABLED`, `PII_RESPONSE_SANITIZATION`) and operational modes (`redact`, `warn`, `block`) allow security teams to balance protection against availability requirements.
- **Audit trail** – Detection counts and redaction events are logged for compliance and forensic analysis.

## Frequently Asked Questions

### How does OmniRoute detect PII in requests and responses?

OmniRoute uses regex-based pattern matching through the `PII_PATTERNS` configuration in [`src/lib/piiSanitizer.ts`](https://github.com/diegosouzapw/OmniRoute/blob/main/src/lib/piiSanitizer.ts). The system scans string fields in request payloads (via `processPII` in the `PIIMaskerGuardrail`) and response outputs (via `sanitizePII`), replacing matches with `[REDACTED]` placeholders when the corresponding feature flags are enabled.

### What types of credentials does OmniRoute automatically mask?

The framework masks **authorization headers** (Bearer tokens, Basic auth), **cookie values**, **API keys** (via `maskApiKey` and `maskSegment`), and **email addresses** (via `maskEmail`). The `maskSecret` utility specifically targets sensitive HTTP headers including `authorization`, `cookie`, and `set-cookie` in MITM-recorded traffic and logs.

### Can I configure OmniRoute to block requests containing PII instead of redacting them?

Yes. Set the `PII_RESPONSE_SANITIZATION_MODE` environment variable to `block` (lines 23-31 in [`src/lib/piiSanitizer.ts`](https://github.com/diegosouzapw/OmniRoute/blob/main/src/lib/piiSanitizer.ts)). In this mode, the system prevents responses containing detected PII from reaching the client entirely, rather than simply redacting the sensitive content. Request-side blocking behavior depends on your specific implementation of the `PIIMaskerGuardrail` callback logic.

### Are the PII redaction features enabled by default in OmniRoute?

No. According to the feature flag definitions in [`src/shared/constants/featureFlagDefinitions.ts`](https://github.com/diegosouzapw/OmniRoute/blob/main/src/shared/constants/featureFlagDefinitions.ts) (lines 51-63), both `PII_REDACTION_ENABLED` and `PII_RESPONSE_SANITIZATION` default to `false`. Operators must explicitly enable these protections via environment variables or database configuration to activate the guard-rail system.