OmniRoute Security Guardrails for PII Redaction and Credential Masking: A Technical Deep Dive

OmniRoute implements a layered guard-rail system that automatically redacts personally identifiable information (PII) in both incoming requests and outgoing provider responses while masking secret values like API keys and tokens in logs, UI displays, and intercepted traffic.

OmniRoute (diegosouzapw/OmniRoute) is an open-source AI gateway that embeds comprehensive security guardrails to prevent sensitive data leakage. The framework provides configurable PII redaction and credential masking capabilities that operate at multiple layers of the request lifecycle, ensuring that sensitive identifiers never leave the server in clear text.

Request-Side PII Redaction with PIIMaskerGuardrail

The PIIMaskerGuardrail class, registered in src/lib/guardrails/registry.ts, intercepts and sanitizes incoming payloads before they reach AI providers. When the PII_REDACTION_ENABLED feature flag is active, the guardrail clones the request object and traverses every string field—including messages, system prompts, input, and prompt parameters—applying the processPII sanitizer (lines 14-22 in src/lib/guardrails/piiMasker.ts).

Detected PII entities are replaced with standardized placeholders, and the system increments a detection count for audit trails. This ensures that user-submitted social security numbers, email addresses, and phone numbers never transit to third-party model providers.

Response-Side PII Sanitization

After provider responses return, the maskResponsesOutput function scans the output_text field and any items within the output array, invoking sanitizePII from src/lib/piiSanitizer.ts (lines 51-61 in piiMasker.ts). The sanitizer applies a configurable set of regex patterns defined in PII_PATTERNS to identify sensitive data embedded in model outputs.

Operators control the enforcement behavior via PII_RESPONSE_SANITIZATION_MODE, which supports three distinct modes (lines 23-31 in src/lib/piiSanitizer.ts):

• redact – Removes detected PII and replaces it with placeholders
• warn – Logs detection events but preserves the original content
• block – Prevents the response from reaching the client entirely when PII is detected

Credential and Secret Masking Across the Stack

MITM Proxy Header Sanitization

When the MITM proxy records traffic for the Inspector UI, the maskSecret utility from src/mitm/maskSecrets.ts automatically replaces sensitive header values—including authorization, cookie, and set-cookie—with [REDACTED] placeholders (lines 2-12). The sanitizeHeaders.ts wrapper applies this masking to both incoming and outgoing headers before storage (lines 3-13 in src/mitm/sanitizeHeaders.ts), ensuring that bearer tokens and session identifiers remain protected in inspection logs.

Log Payload Protection

All log entries pass through sanitizePayloadPII in src/lib/logPayloads.ts (lines 1-9), which internally calls sanitizePII to strip any residual PII that may have slipped into debug output or error traces. This prevents accidental exposure of sensitive data in centralized logging systems.

UI Display Masking

For user interface elements, maskApiKey in src/lib/services/apiKey.ts (lines 40-45) utilizes maskSegment from src/shared/utils/formatting.ts to partially obscure API key identifiers—showing only the first and last few characters—while maintaining enough visibility for users to recognize the key. Similarly, maskEmail in src/shared/utils/maskEmail.ts (lines 2-13) obscures the user portion and domain of email addresses unless the UI explicitly requests full visibility.

Feature Flag Configuration

All guard-rails respect feature flags defined in src/shared/constants/featureFlagDefinitions.ts. By default, both PII_REDACTION_ENABLED (request-side) and PII_RESPONSE_SANITIZATION (response-side) are set to false (lines 51-63).

Operators enable protection via environment variables or database-stored configurations:

# Enable request-side PII redaction

PII_REDACTION_ENABLED=true

# Enable response sanitization with block mode

PII_RESPONSE_SANITIZATION=true
PII_RESPONSE_SANITIZATION_MODE=block

The system logs redaction events for compliance auditing, creating an immutable record of when sensitive data was detected and removed.

Practical Implementation Examples

The following examples demonstrate how to manually invoke OmniRoute's sanitization utilities in custom middleware or plugins:

// Example: manually redacting a request payload before sending it to a provider
import { cloneAndMaskRequestPayload } from "@/lib/guardrails/piiMasker";

const original = { messages: [{ role: "user", content: "My SSN is 123-45-6789" }] };
const { payload, modified, detections } = cloneAndMaskRequestPayload(original);
console.log(modified);        // true
console.log(payload.messages[0].content); // "My SSN is [REDACTED]"

// Example: sanitizing a provider response before returning to the client
import { sanitizePIIResponse } from "@/lib/piiSanitizer";

const llmResponse = {
  output_text: "Contact me at alice@example.com",
};
const sanitized = sanitizePIIResponse(llmResponse);
console.log(sanitized.output_text); // "Contact me at [REDACTED]"

// Example: masking a secret header in MITM inspection logs
import { maskSecret } from "@/mitm/maskSecrets";

const rawHeaders = { authorization: "Bearer abc123xyz" };
const safeHeaders = { authorization: maskSecret(rawHeaders.authorization) };
console.log(safeHeaders.authorization); // "[REDACTED]"

Summary

• Layered protection – OmniRoute applies guard-rails at ingress, egress, and persistence layers to ensure PII never leaks through requests, responses, or logs.
• Bidirectional sanitization – The PIIMaskerGuardrail processes incoming payloads while sanitizePIIResponse handles provider outputs, creating comprehensive coverage.
• Credential masking – Secrets in headers (maskSecret), logs (sanitizePayloadPII), and UI displays (maskApiKey, maskEmail) are automatically redacted using consistent [REDACTED] patterns.
• Configurable enforcement – Feature flags (PII_REDACTION_ENABLED, PII_RESPONSE_SANITIZATION) and operational modes (redact, warn, block) allow security teams to balance protection against availability requirements.
• Audit trail – Detection counts and redaction events are logged for compliance and forensic analysis.

Frequently Asked Questions

How does OmniRoute detect PII in requests and responses?

OmniRoute uses regex-based pattern matching through the PII_PATTERNS configuration in src/lib/piiSanitizer.ts. The system scans string fields in request payloads (via processPII in the PIIMaskerGuardrail) and response outputs (via sanitizePII), replacing matches with [REDACTED] placeholders when the corresponding feature flags are enabled.

What types of credentials does OmniRoute automatically mask?

The framework masks authorization headers (Bearer tokens, Basic auth), cookie values, API keys (via maskApiKey and maskSegment), and email addresses (via maskEmail). The maskSecret utility specifically targets sensitive HTTP headers including authorization, cookie, and set-cookie in MITM-recorded traffic and logs.

Can I configure OmniRoute to block requests containing PII instead of redacting them?

Yes. Set the PII_RESPONSE_SANITIZATION_MODE environment variable to block (lines 23-31 in src/lib/piiSanitizer.ts). In this mode, the system prevents responses containing detected PII from reaching the client entirely, rather than simply redacting the sensitive content. Request-side blocking behavior depends on your specific implementation of the PIIMaskerGuardrail callback logic.

Are the PII redaction features enabled by default in OmniRoute?

No. According to the feature flag definitions in src/shared/constants/featureFlagDefinitions.ts (lines 51-63), both PII_REDACTION_ENABLED and PII_RESPONSE_SANITIZATION default to false. Operators must explicitly enable these protections via environment variables or database configuration to activate the guard-rail system.

{
  "mcpServers": {
    "instagit": {
      "command": "npx",
      "args": ["-y", "instagit@latest"]
    }
  }
}