# OmniRoute Security Features and Guardrails: A Complete Technical Guide

> Explore OmniRoute's multi-layered security architecture. Discover prompt injection detection, PII masking, credential sanitization, and more. Control guardrails via HTTP headers and env vars.

- Repository: [Diego Rodrigues de Sa e Souza/OmniRoute](https://github.com/diegosouzapw/OmniRoute)
- Tags: deep-dive
- Published: 2026-08-27

---

**OmniRoute implements a multi-layered security architecture with six core guardrails—including prompt injection detection, PII masking, credential sanitization, and vision/video bridge protections—that can be selectively controlled via HTTP headers and environment variables.**

The [diegosouzapw/OmniRoute](https://github.com/diegosouzapw/OmniRoute) repository provides an enterprise-grade routing layer for LLM requests, embedding security controls directly into the request pipeline. These **guardrails** operate on every request by default, analyzing payloads for injection attempts, sensitive data leakage, and unsafe media content before reaching upstream providers.

## Overview of the OmniRoute Guardrail Architecture

OmniRoute's security model follows a defense-in-depth strategy where guardrails run as lightweight middleware and library functions. According to the source code in [[`src/middleware/promptInjectionGuard.ts`](https://github.com/diegosouzapw/OmniRoute/blob/main/src/middleware/promptInjectionGuard.ts)](https://github.com/diegosouzapw/OmniRoute/blob/release/v3.8.51/src/middleware/promptInjectionGuard.ts) and the guardrail definitions in [[`docs/security/GUARDRAILS.md`](https://github.com/diegosouzapw/OmniRoute/blob/main/docs/security/GUARDRAILS.md)](https://github.com/diegosouzapw/OmniRoute/blob/release/v3.8.51/docs/security/GUARDRAILS.md), each guardrail can operate in `warn` mode (logging suspicious activity) or `block` mode (rejecting requests with HTTP 400), while remaining bypassable per-request via the `x-omniroute-disabled-guardrails` header.

The architecture splits protection across three domains:

- **Request sanitization** – scans incoming prompts for injection patterns and removes PII/credentials before forwarding
- **Response sanitization** – analyzes LLM outputs for leaked sensitive data
- **Media validation** – enforces size limits and content policies on vision and video inputs

## Core Security Guardrails Implementation

### Prompt Injection Guard

The **Prompt Injection Guard** monitors request payloads for known attack patterns such as "ignore previous instructions" or system prompt leakage attempts. Implemented in [[`src/middleware/promptInjectionGuard.ts`](https://github.com/diegosouzapw/OmniRoute/blob/main/src/middleware/promptInjectionGuard.ts)](https://github.com/diegosouzapw/OmniRoute/blob/release/v3.8.51/src/middleware/promptInjectionGuard.ts), this middleware evaluates every incoming request against pattern databases and applies the action specified by the `INPUT_SANITIZER_MODE` environment variable.

By default, the guardrail runs in `warn` mode, logging suspicious prompts to the observability stack without blocking traffic. When configured to `block`, it returns an HTTP 400 error with a sanitization notice before the request reaches the LLM provider.

### PII Masker (Request-Side)

The **PII Masker** redacts personally identifiable information—including email addresses, phone numbers, SSNs, and credit card numbers—from request payloads before upstream transmission. Located in [[`src/lib/guardrails/piiMasker.ts`](https://github.com/diegosouzapw/OmniRoute/blob/main/src/lib/guardrails/piiMasker.ts)](https://github.com/diegosouzapw/OmniRoute/blob/release/v3.8.51/src/lib/guardrails/piiMasker.ts), this guardrail uses regex-based pattern matching to identify sensitive entities and replace them with tokenized placeholders like `[REDACTED_EMAIL]`.

This feature is **opt-in** and controlled via the `PII_REDACTION_ENABLED` environment variable, which defaults to `false` in [[`src/shared/constants/featureFlagDefinitions.ts`](https://github.com/diegosouzapw/OmniRoute/blob/main/src/shared/constants/featureFlagDefinitions.ts)](https://github.com/diegosouzapw/OmniRoute/blob/release/v3.8.51/src/shared/constants/featureFlagDefinitions.ts) to prevent unintended data mutation in self-hosted deployments.

### Credential Masker

Complementing the PII Masker, the **Credential Masker** specifically targets API keys, secret tokens, and private key patterns in both request and response bodies. Found in [[`src/lib/guardrails/credentialMasker.ts`](https://github.com/diegosouzapw/OmniRoute/blob/main/src/lib/guardrails/credentialMasker.ts)](https://github.com/diegosouzapw/OmniRoute/blob/release/v3.8.51/src/lib/guardrails/credentialMasker.ts), this guardrail prevents accidental credential exposure in logs or downstream responses. It operates under the `CREDENTIAL_REDACTION_ENABLED` feature flag, defaulting to disabled.

### Response-Side PII Sanitizer

Distinct from the request-side masker, the **PII Sanitizer** scans LLM responses for leaked personal data before returning them to clients. Implemented in [[`src/lib/piiSanitizer.ts`](https://github.com/diegosouzapw/OmniRoute/blob/main/src/lib/piiSanitizer.ts)](https://github.com/diegosouzapw/OmniRoute/blob/release/v3.8.51/src/lib/piiSanitizer.ts), this component can redact specific entities, flag responses for review, or drop entire messages containing high-confidence PII matches. This ensures generated content does not expose user data from training sets or context windows.

### Vision Bridge Guardrail

The **Vision Bridge Guardrail** validates image inputs before processing by vision-capable models. Defined in [[`src/lib/guardrails/visionBridge.ts`](https://github.com/diegosouzapw/OmniRoute/blob/main/src/lib/guardrails/visionBridge.ts)](https://github.com/diegosouzapw/OmniRoute/blob/release/v3.8.51/src/lib/guardrails/visionBridge.ts), this guardrail enforces strict size limits (approximately 36 MiB for inline images, 50 MiB for remote URLs) and performs content safety checks to prevent oversized or malicious image attacks. The guardrail automatically intercepts calls to vision models and can be bypassed per-request using the disable-header mechanism.

### Video Bridge Guardrail

Similarly, the **Video Bridge Guardrail** in [[`src/lib/guardrails/videoBridge.ts`](https://github.com/diegosouzapw/OmniRoute/blob/main/src/lib/guardrails/videoBridge.ts)](https://github.com/diegosouzapw/OmniRoute/blob/release/v3.8.51/src/lib/guardrails/videoBridge.ts) controls video extraction pipelines, disabling unsafe remote MOV file references and imposing processing latency limits to prevent resource exhaustion attacks. This guardrail is enabled by default but configurable via feature flags for specialized deployment scenarios.

## Controlling Guardrails via Headers and Environment

### Disabling Guardrails Per-Request

All guardrails can be selectively disabled for individual requests by supplying the `x-omniroute-disabled-guardrails` HTTP header with a comma-separated list of guardrail identifiers:

```typescript
import fetch from 'node-fetch';

await fetch('https://localhost:20128/v1/chat/completions', {
  method: 'POST',
  headers: {
    'Content-Type': 'application/json',
    'x-omniroute-disabled-guardrails': 'injection,pii,vision-bridge',
  },
  body: JSON.stringify({
    model: 'gpt-4o',
    messages: [{ role: 'user', content: 'Process this image' }],
  }),
});

```

The header parser removes specified guards only for that call, maintaining security defaults for subsequent requests.

### Enabling PII Redaction via Environment Variables

Enable request-side PII protection by setting environment variables before starting the OmniRoute instance:

```bash

# .env configuration

PII_REDACTION_ENABLED=true
INPUT_SANITIZER_MODE=block
CREDENTIAL_REDACTION_ENABLED=true
PII_RESPONSE_SANITIZATION=true

```

As documented in [[`docs/reference/ENVIRONMENT.md`](https://github.com/diegosouzapw/OmniRoute/blob/main/docs/reference/ENVIRONMENT.md)](https://github.com/diegosouzapw/OmniRoute/blob/release/v3.8.51/docs/reference/ENVIRONMENT.md), these variables activate the corresponding guardrails in [[`src/shared/constants/featureFlagDefinitions.ts`](https://github.com/diegosouzapw/OmniRoute/blob/main/src/shared/constants/featureFlagDefinitions.ts)](https://github.com/diegosouzapw/OmniRoute/blob/release/v3.8.51/src/shared/constants/featureFlagDefinitions.ts), specifically lines 61-63 which control sanitization defaults.

### Programmatic Guardrail Inspection

Inspect active guardrails within custom handlers using the registry utilities:

```typescript
import { getGuardrailStatus } from '@/lib/guardrails/registry';

export async function handler(req) {
  const status = getGuardrailStatus(req);
  console.log('Active guardrails:', status.active);
  // Output: ["credential", "vision-bridge", "injection"]
}

```

### Vision Bridge Implementation Example

Safely invoke vision models through the guardrail wrapper:

```typescript
import { VisionBridgeGuardrail } from '@/lib/guardrails/visionBridge';
import { callVisionModel } from '@/lib/guardrails/visionBridgeHelpers';

const imgBuffer = await fetch('https://example.com/photo.jpg')
  .then(r => r.buffer());

const result = await VisionBridgeGuardrail.run(async () => {
  return callVisionModel(imgBuffer, { model: 'gpt-4o-vision' });
});

```

## Summary

- **Prompt Injection Guard** ([`src/middleware/promptInjectionGuard.ts`](https://github.com/diegosouzapw/OmniRoute/blob/main/src/middleware/promptInjectionGuard.ts)) detects malicious prompt patterns with configurable `warn` or `block` modes.
- **PII Masker** ([`src/lib/guardrails/piiMasker.ts`](https://github.com/diegosouzapw/OmniRoute/blob/main/src/lib/guardrails/piiMasker.ts)) redacts personal data from requests when `PII_REDACTION_ENABLED` is set to `true`.
- **Credential Masker** ([`src/lib/guardrails/credentialMasker.ts`](https://github.com/diegosouzapw/OmniRoute/blob/main/src/lib/guardrails/credentialMasker.ts)) sanitizes API keys and secrets from request/response bodies.
- **PII Sanitizer** ([`src/lib/piiSanitizer.ts`](https://github.com/diegosouzapw/OmniRoute/blob/main/src/lib/piiSanitizer.ts)) scans LLM responses for leaked sensitive information before client delivery.
- **Vision Bridge** ([`src/lib/guardrails/visionBridge.ts`](https://github.com/diegosouzapw/OmniRoute/blob/main/src/lib/guardrails/visionBridge.ts)) enforces 36-50 MiB image limits and content validation for vision inputs.
- **Video Bridge** ([`src/lib/guardrails/videoBridge.ts`](https://github.com/diegosouzapw/OmniRoute/blob/main/src/lib/guardrails/videoBridge.ts)) controls video extraction pipelines and blocks unsafe remote references.
- **Feature Flags** ([`src/shared/constants/featureFlagDefinitions.ts`](https://github.com/diegosouzapw/OmniRoute/blob/main/src/shared/constants/featureFlagDefinitions.ts)) default all PII-related guardrails to disabled to prevent accidental data mutation.
- **Per-Request Control** via the `x-omniroute-disabled-guardrails` header allows temporary bypass of specific protections without configuration changes.

## Frequently Asked Questions

### How do I disable OmniRoute guardrails for a single request?

Supply the `x-omniroute-disabled-guardrails` header with a comma-separated list of guardrail names such as `injection`, `pii`, `vision-bridge`, or `video-bridge`. The core request pipeline parses this header in [`src/middleware/promptInjectionGuard.ts`](https://github.com/diegosouzapw/OmniRoute/blob/main/src/middleware/promptInjectionGuard.ts) and removes the specified protections for that call only, maintaining security defaults for all other traffic.

### What is the difference between the PII Masker and PII Sanitizer?

The **PII Masker** in [`src/lib/guardrails/piiMasker.ts`](https://github.com/diegosouzapw/OmniRoute/blob/main/src/lib/guardrails/piiMasker.ts) operates on the request side, redacting personal information before it reaches the LLM provider. The **PII Sanitizer** in [`src/lib/piiSanitizer.ts`](https://github.com/diegosouzapw/OmniRoute/blob/main/src/lib/piiSanitizer.ts) operates on the response side, scanning LLM outputs for leaked personal data before returning them to the client. Both use similar pattern recognition but protect different stages of the request lifecycle.

### Are security features enabled by default in OmniRoute?

No. According to the feature flag definitions in [`src/shared/constants/featureFlagDefinitions.ts`](https://github.com/diegosouzapw/OmniRoute/blob/main/src/shared/constants/featureFlagDefinitions.ts), PII redaction, credential masking, and response sanitization default to `false` to prevent unintended data modification. Only the Prompt Injection Guard and media bridge guardrails (Vision/Video) are active by default, operating in `warn` mode rather than blocking mode.

### How does the Vision Bridge Guardrail protect against malicious images?

The Vision Bridge Guardrail in [`src/lib/guardrails/visionBridge.ts`](https://github.com/diegosouzapw/OmniRoute/blob/main/src/lib/guardrails/visionBridge.ts) validates image payloads against size constraints (approximately 36 MiB for inline base64, 50 MiB for remote URLs) and performs content safety checks before invoking vision models. It prevents buffer overflow attacks and ensures only properly formatted, safe images enter the processing pipeline, returning HTTP 400 errors for violations.