mask recognized secrets before your configured upstream receives them.
Promtect is a local loopback proxy with 96 known-format detector kinds. On supported, uncompressed UTF-8 request bodies routed through it, recognized matches are masked before the remaining prompt is forwarded. Transparent mode restores unchanged sentinels in the streamed reply; strict mode keeps them masked.
local loopback proxy · no Promtect telemetry in Core · no root certificate · bounded protection scope
the gap cloud DLP and destructive redactors leave open.
Some cloud DLP products send content to another vendor for inspection. Destructive redactors can remove context the model needs. Promtect's detection and per-request vault run locally: supported matches are replaced with sentinels before the remaining prompt reaches the upstream, then unchanged sentinels can be restored in the reply.
Local Core, no hosted control plane
Core runs as a loopback proxy on 127.0.0.1. Detection happens on your machine, and Core contains no Promtect telemetry or hosted control-plane dependency. The remaining masked prompt still goes to the upstream you configure.
No root CA
No TLS interception, no certificate to install in your trust store. Point your tool's base URL at the proxy and you're done. Nothing else on your machine gets a window into your traffic.
Reversible restore
The model answers about «aws_key», Promtect swaps the real value back in the reply, token by token as it streams. Or set PROMTECT_RESTORE=false and keep everything masked.
Value-free audit design beta
Audit records are designed to contain detector names, counts, timestamps, and request metadata, not detected values. The per-request vault explicitly zeroizes the secret values it owns on drop; that is not a claim that every process or library memory copy is zeroized.
You can't un-send it
Once a key reaches a provider, its handling follows that provider's retention policy. For covered formats and supported request bodies routed through Promtect, masking reduces the chance that the recognized value reaches the configured upstream.
the same workflow, covered matches masked locally.
For recognized matches in supported request bodies routed through Promtect, the configured upstream receives a sentinel instead of the matched value.
- !Your AWS key leaves your machine inside the request.It's now in a provider log on hardware you don't own.
- !Or you redact it by hand and the model returns broken code.It can't reason about a value it never saw.
- !Every tool you wire up is one more place a key can pass through.The surface area grew; nobody got careless.
- !Your only fix after the fact is rotation.And you have to assume the old key is already compromised.
- ✓A recognized key in a supported request body is replaced before forwarding.The configured upstream receives a sentinel for that covered match.
- ✓An unchanged sentinel can be restored as the reply streams back.Strict mode never restores plaintext.
- ✓Detection and the per-request vault run on 127.0.0.1.Core contains no Promtect telemetry or hosted control-plane dependency.
- ✓Value-free audit records are a beta capability.They are designed to record detector names and counts, not detected values.
| capability | Promtect | cloud DLP | redactor proxy |
|---|---|---|---|
| Detection and request vault run locally | yes | varies | varies |
| Restores real values in the reply | yes | no | no |
| No root certificate to install | yes | n/a | often no |
| Audit designed without detected values | beta | varies | varies |
Core recognizes known formats. Some things have no format.
Core matches published key shapes, and that covers most of what leaks. The rows marked coming are the gaps I am working on next.
96 known-format detector kinds
AWS, OpenAI, Anthropic, GitHub, GitLab, Slack, Google, and the rest. Each one matches a published key format by its prefix and shape.
Credentials with no published shape
A format detector needs a format. Plenty of the strings worth protecting were never given one, so nothing that matches on shape will ever see them.
Personal and account data
Names, records, and account numbers ride along in prompts too. A detector built to recognize keys does not notice any of it going past.
Config files you did not write
Tool config on disk can carry a token you never typed. It loads before anything has a chance to look at it.
What comes back, not just what goes out
Promtect reads the request today. The reply is the other half of the round trip, and nothing is reading that yet.
Free is the whole proxy.
Known-format masking, streaming restoration, and strict mode are available Core capabilities. The Core edition itself is beta; its dashboard and value-free audit are also beta.
local visibility, currently beta.
The beta local dashboard summarizes masked counts and detector names from audit records designed not to contain detected values. It is a diagnostic surface, not proof that every possible secret was found.
Audit and dashboard records are intended to summarize the matches active detectors reported. They do not establish coverage for excluded bodies, traffic that bypasses the proxy, or formats no active detector recognizes.
Core is free, and it is the whole proxy.
Every detector, the masking, the restore, strict mode. No account, no expiry, nothing held back.
the questions I'd ask too.
Does anything reach a Promtect server?+
127.0.0.1. Core contains no Promtect telemetry or hosted control-plane dependency. Promtect still forwards the remaining masked prompt to the upstream you configure, and request authorization headers pass through.How does it intercept traffic without a root certificate?+
http://127.0.0.1:8790. No TLS interception, no certificate to install, no man-in-the-middle on the rest of your machine. The proxy only sees the traffic you route through it.If the model only sees a placeholder, how is the answer useful?+
«aws_key» as a placeholder and returns working code around it. Promtect restores the real value in the reply as it streams back, so the code runs as written. Prefer the value never comes back? Set PROMTECT_RESTORE=false for strict mode and it stays masked.Is Core all of it?+
Is the audit log a place my secrets could leak from?+
zeroize for values it owns when dropped. Promtect does not claim that every memory copy made by the process, libraries, operating system, or upstream tooling is zeroized.Which tools does it work with?+
What license does Core use?+
you can rotate the key.
you can't un-send it.
Put a backstop between your AI tool and the model. Stay careful, and catch the one that slips through.