OmniRoute Security Features and Guardrails: A Complete Technical Guide

OmniRoute implements a multi-layered security architecture with six core guardrails—including prompt injection detection, PII masking, credential sanitization, and vision/video bridge protections—that can be selectively controlled via HTTP headers and environment variables.

The diegosouzapw/OmniRoute repository provides an enterprise-grade routing layer for LLM requests, embedding security controls directly into the request pipeline. These guardrails operate on every request by default, analyzing payloads for injection attempts, sensitive data leakage, and unsafe media content before reaching upstream providers.

Overview of the OmniRoute Guardrail Architecture

OmniRoute's security model follows a defense-in-depth strategy where guardrails run as lightweight middleware and library functions. According to the source code in [src/middleware/promptInjectionGuard.ts](https://github.com/diegosouzapw/OmniRoute/blob/release/v3.8.51/src/middleware/promptInjectionGuard.ts) and the guardrail definitions in [docs/security/GUARDRAILS.md](https://github.com/diegosouzapw/OmniRoute/blob/release/v3.8.51/docs/security/GUARDRAILS.md), each guardrail can operate in warn mode (logging suspicious activity) or block mode (rejecting requests with HTTP 400), while remaining bypassable per-request via the x-omniroute-disabled-guardrails header.

The architecture splits protection across three domains:

• Request sanitization – scans incoming prompts for injection patterns and removes PII/credentials before forwarding
• Response sanitization – analyzes LLM outputs for leaked sensitive data
• Media validation – enforces size limits and content policies on vision and video inputs

Core Security Guardrails Implementation

Prompt Injection Guard

The Prompt Injection Guard monitors request payloads for known attack patterns such as "ignore previous instructions" or system prompt leakage attempts. Implemented in [src/middleware/promptInjectionGuard.ts](https://github.com/diegosouzapw/OmniRoute/blob/release/v3.8.51/src/middleware/promptInjectionGuard.ts), this middleware evaluates every incoming request against pattern databases and applies the action specified by the INPUT_SANITIZER_MODE environment variable.

By default, the guardrail runs in warn mode, logging suspicious prompts to the observability stack without blocking traffic. When configured to block, it returns an HTTP 400 error with a sanitization notice before the request reaches the LLM provider.

PII Masker (Request-Side)

The PII Masker redacts personally identifiable information—including email addresses, phone numbers, SSNs, and credit card numbers—from request payloads before upstream transmission. Located in [src/lib/guardrails/piiMasker.ts](https://github.com/diegosouzapw/OmniRoute/blob/release/v3.8.51/src/lib/guardrails/piiMasker.ts), this guardrail uses regex-based pattern matching to identify sensitive entities and replace them with tokenized placeholders like [REDACTED_EMAIL].

This feature is opt-in and controlled via the PII_REDACTION_ENABLED environment variable, which defaults to false in [src/shared/constants/featureFlagDefinitions.ts](https://github.com/diegosouzapw/OmniRoute/blob/release/v3.8.51/src/shared/constants/featureFlagDefinitions.ts) to prevent unintended data mutation in self-hosted deployments.

Credential Masker

Complementing the PII Masker, the Credential Masker specifically targets API keys, secret tokens, and private key patterns in both request and response bodies. Found in [src/lib/guardrails/credentialMasker.ts](https://github.com/diegosouzapw/OmniRoute/blob/release/v3.8.51/src/lib/guardrails/credentialMasker.ts), this guardrail prevents accidental credential exposure in logs or downstream responses. It operates under the CREDENTIAL_REDACTION_ENABLED feature flag, defaulting to disabled.

Response-Side PII Sanitizer

Distinct from the request-side masker, the PII Sanitizer scans LLM responses for leaked personal data before returning them to clients. Implemented in [src/lib/piiSanitizer.ts](https://github.com/diegosouzapw/OmniRoute/blob/release/v3.8.51/src/lib/piiSanitizer.ts), this component can redact specific entities, flag responses for review, or drop entire messages containing high-confidence PII matches. This ensures generated content does not expose user data from training sets or context windows.

Vision Bridge Guardrail

The Vision Bridge Guardrail validates image inputs before processing by vision-capable models. Defined in [src/lib/guardrails/visionBridge.ts](https://github.com/diegosouzapw/OmniRoute/blob/release/v3.8.51/src/lib/guardrails/visionBridge.ts), this guardrail enforces strict size limits (approximately 36 MiB for inline images, 50 MiB for remote URLs) and performs content safety checks to prevent oversized or malicious image attacks. The guardrail automatically intercepts calls to vision models and can be bypassed per-request using the disable-header mechanism.

Video Bridge Guardrail

Similarly, the Video Bridge Guardrail in [src/lib/guardrails/videoBridge.ts](https://github.com/diegosouzapw/OmniRoute/blob/release/v3.8.51/src/lib/guardrails/videoBridge.ts) controls video extraction pipelines, disabling unsafe remote MOV file references and imposing processing latency limits to prevent resource exhaustion attacks. This guardrail is enabled by default but configurable via feature flags for specialized deployment scenarios.

Controlling Guardrails via Headers and Environment

Disabling Guardrails Per-Request

All guardrails can be selectively disabled for individual requests by supplying the x-omniroute-disabled-guardrails HTTP header with a comma-separated list of guardrail identifiers:

import fetch from 'node-fetch';

await fetch('https://localhost:20128/v1/chat/completions', {
  method: 'POST',
  headers: {
    'Content-Type': 'application/json',
    'x-omniroute-disabled-guardrails': 'injection,pii,vision-bridge',
  },
  body: JSON.stringify({
    model: 'gpt-4o',
    messages: [{ role: 'user', content: 'Process this image' }],
  }),
});

The header parser removes specified guards only for that call, maintaining security defaults for subsequent requests.

Enabling PII Redaction via Environment Variables

Enable request-side PII protection by setting environment variables before starting the OmniRoute instance:

# .env configuration

PII_REDACTION_ENABLED=true
INPUT_SANITIZER_MODE=block
CREDENTIAL_REDACTION_ENABLED=true
PII_RESPONSE_SANITIZATION=true

As documented in [docs/reference/ENVIRONMENT.md](https://github.com/diegosouzapw/OmniRoute/blob/release/v3.8.51/docs/reference/ENVIRONMENT.md), these variables activate the corresponding guardrails in [src/shared/constants/featureFlagDefinitions.ts](https://github.com/diegosouzapw/OmniRoute/blob/release/v3.8.51/src/shared/constants/featureFlagDefinitions.ts), specifically lines 61-63 which control sanitization defaults.

Programmatic Guardrail Inspection

Inspect active guardrails within custom handlers using the registry utilities:

import { getGuardrailStatus } from '@/lib/guardrails/registry';

export async function handler(req) {
  const status = getGuardrailStatus(req);
  console.log('Active guardrails:', status.active);
  // Output: ["credential", "vision-bridge", "injection"]
}

Vision Bridge Implementation Example

Safely invoke vision models through the guardrail wrapper:

import { VisionBridgeGuardrail } from '@/lib/guardrails/visionBridge';
import { callVisionModel } from '@/lib/guardrails/visionBridgeHelpers';

const imgBuffer = await fetch('https://example.com/photo.jpg')
  .then(r => r.buffer());

const result = await VisionBridgeGuardrail.run(async () => {
  return callVisionModel(imgBuffer, { model: 'gpt-4o-vision' });
});

Summary

• Prompt Injection Guard (src/middleware/promptInjectionGuard.ts) detects malicious prompt patterns with configurable warn or block modes.
• PII Masker (src/lib/guardrails/piiMasker.ts) redacts personal data from requests when PII_REDACTION_ENABLED is set to true.
• Credential Masker (src/lib/guardrails/credentialMasker.ts) sanitizes API keys and secrets from request/response bodies.
• PII Sanitizer (src/lib/piiSanitizer.ts) scans LLM responses for leaked sensitive information before client delivery.
• Vision Bridge (src/lib/guardrails/visionBridge.ts) enforces 36-50 MiB image limits and content validation for vision inputs.
• Video Bridge (src/lib/guardrails/videoBridge.ts) controls video extraction pipelines and blocks unsafe remote references.
• Feature Flags (src/shared/constants/featureFlagDefinitions.ts) default all PII-related guardrails to disabled to prevent accidental data mutation.
• Per-Request Control via the x-omniroute-disabled-guardrails header allows temporary bypass of specific protections without configuration changes.

Frequently Asked Questions

How do I disable OmniRoute guardrails for a single request?

Supply the x-omniroute-disabled-guardrails header with a comma-separated list of guardrail names such as injection, pii, vision-bridge, or video-bridge. The core request pipeline parses this header in src/middleware/promptInjectionGuard.ts and removes the specified protections for that call only, maintaining security defaults for all other traffic.

What is the difference between the PII Masker and PII Sanitizer?

The PII Masker in src/lib/guardrails/piiMasker.ts operates on the request side, redacting personal information before it reaches the LLM provider. The PII Sanitizer in src/lib/piiSanitizer.ts operates on the response side, scanning LLM outputs for leaked personal data before returning them to the client. Both use similar pattern recognition but protect different stages of the request lifecycle.

Are security features enabled by default in OmniRoute?

No. According to the feature flag definitions in src/shared/constants/featureFlagDefinitions.ts, PII redaction, credential masking, and response sanitization default to false to prevent unintended data modification. Only the Prompt Injection Guard and media bridge guardrails (Vision/Video) are active by default, operating in warn mode rather than blocking mode.

How does the Vision Bridge Guardrail protect against malicious images?

The Vision Bridge Guardrail in src/lib/guardrails/visionBridge.ts validates image payloads against size constraints (approximately 36 MiB for inline base64, 50 MiB for remote URLs) and performs content safety checks before invoking vision models. It prevents buffer overflow attacks and ensures only properly formatted, safe images enter the processing pipeline, returning HTTP 400 errors for violations.

{
  "mcpServers": {
    "instagit": {
      "command": "npx",
      "args": ["-y", "instagit@latest"]
    }
  }
}