GatekeepPROMPT FIREWALL · LIVE DEMO

← PORTFOLIO GITHUB ↗

Gatekeep is a drop-in reverse proxy for the OpenAI API. It scans every prompt before the model sees it: secrets are blocked, personal data is redacted, and every prompt now also passes a prompt-injection screen — instruction overrides, role hijacks, system-prompt leaks, delimiter smuggling, exfiltration channels, and unicode obfuscation are scored against a block threshold. Everything is audit-logged without ever storing the raw text. This page runs the same detection and policy pipeline, ported to JavaScript, entirely in your browser. No API key, no server, nothing leaves this page.

On load, this page replayed both of the repo's red-team corpora through the in-browser engine. harness/corpus.jsonl: 30 dirty prompts and 20 clean traps built to bait false positives (git SHAs, UUIDs, Luhn-invalid cards, invalid SSNs, code). harness/injection_corpus.jsonl: 52 injection attacks across 9 techniques and 48 hard benigns that contain trigger words like “ignore”, “system”, and “developer mode” in innocent contexts. Scoring is strict: actions must match exactly, and injection flagging is judged at the 0.8 block threshold. The JS port is also parity-tested against the Python engine finding-by-finding via demo/parity.test.js — all 150 entries, including per-finding scores and both policy modes.

01 REQUEST
client requests model:
SAMPLES, STRAIGHT FROM THE RED-TEAM CORPUS
INJECTION ATTACKS, FROM THE INJECTION CORPUS
INJECTION MODE
Ctrl+Enter
02 CHECKPOINT DECISION
NO REQUEST INSPECTED YET · send a prompt or hit a sample
03 WHAT THE MODEL SAW
awaiting a request…

04 AUDIT TRAIL
No decisions yet this session.

One row per decision, the same columns as the proxy's SQLite audit table. The raw prompt is never stored: only a SHA-256 of it, the finding categories and detector names, the routing outcome, and the decision latency. That is the never-log rule, and it holds even here, in a page that never leaves your machine.