A regex DLP layer for an LLM gateway: blocking keys, masking IDs, and what to do with chat history

A new open-source LLM gateway project introduces a lightweight Data Loss Prevention (DLP) layer designed to secure interactions before they reach model providers. By utilizing a simple, regex-based rule engine, the system performs real-time scanning to block sensitive credentials like API keys or mask personal identifiers such as credit card numbers. The implementation prioritizes performance and simplicity, opting to scan only the most recent user message to avoid redundant processing of chat history. The author argues that while regex-based DLP cannot catch complex semantic leaks, it provides a highly effective, low-latency defense against common accidental data exposures. The gateway is designed for self-hosting and emphasizes a 'boring' architecture, using file-based configuration for hot-reloading without complex caching layers. This approach offers a practical, immediate security improvement for teams integrating LLMs into their infrastructure.