LEANROUTE

Guardrails

Curated safety library, one-click enable.

Seven rules cover the most common LLM-request safety concerns: PII, credentials, prompt injection, content moderation, data exfiltration, profanity, and language gating. Configure per-rule action (block, redact, or log-only), direction (inbound, outbound, or both), and severity threshold. Custom regex block/redact patterns run alongside for org-specific needs. Manage at /dashboard/guardrails.

leanroute.dev/dashboard/guardrails
Leanroute guardrails library — dashboard showing PII redaction, secret detection, prompt injection detection, OpenAI moderation, data exfiltration, profanity filter, and language / region gate with per-rule action, direction, and severity dropdowns

The library

PII redaction

piidefault: redact · both

Emails, phone numbers, SSNs, credit-card numbers (Luhn-verified), and IBAN. Configurable per class.

Secret / credential detection

secretdefault: block · both

OpenAI / Anthropic / Stripe / GitHub / AWS / Google tokens, JWTs, private-key headers.

Prompt injection detection

injectiondefault: block · inbound

Known templates: ignore-previous-instructions, role-swap, jailbreak framing, system-prompt-leak. Regex Phase 1; classifier upgrade planned.

OpenAI moderation pre-check

moderationdefault: block · inbound

Hate, violence, self-harm, sexual, illegal-activity content. Adds ~200–500ms; requires gateway's OPENAI_API_KEY env.

Data exfiltration detection

exfildefault: block · outbound

Outbound only. Catches responses that leak the system prompt, dump DB schemas, or regenerate credentials.

Profanity filter

profanitydefault: redact · outbound

English word list included; Hindi + Chinese planned. Configurable per language.

Language / region gate

languagedefault: block · outbound

Restricts responses to an allowlist of languages via lightweight character-range heuristic.

Preview mode

Enable any rule with the "Preview 7 days" button and the runtime forces the action to log_only for the window — matching requests still succeed but the response header x-gateway-guardrails-triggered fires so you can see what would have been blocked on your real traffic. When you're comfortable, flip the action to block or redact. No rule kills production on its first false positive.

How it shows up in the API

Block actions return 400 prompt_blocked with a scope + rule id so your client can show a useful error:

{
  "error": {
    "code": "prompt_blocked",
    "message": "Your prompt was flagged by the content moderation pre-check. ...",
    "scope": "library",
    "pattern": "secret-detection",
    "support_url": "mailto:[email protected]"
  }
}

Redact and log-only actions return 200 with the response header x-gateway-guardrails-triggered: rule-id,rule-id listing every rule that fired regardless of action. Full header reference at /docs/headers.

Custom regex on top

Alongside the library, orgs can add regex block or redact rules for org-specific terms (customer names, project code names, internal URLs). Library rules run first; custom regex second. Same 400/header contract. Configure at /dashboard/settings · Guardrails.

Want deeper detection?

Our library covers the common cases well. For heavier requirements — named-entity PII with model-backed accuracy, adversarial prompt-injection defense, canary-token jailbreak detection — layer a specialist in front of Leanroute:

PII detection + redaction

Microsoft Presidio

Open source, model-backed. Handles names, addresses, IDs, account numbers across many locales.

Integration guide →

Prompt injection defense

Lakera Guard

Hosted SaaS. Detects prompt-injection attacks with a classifier trained on real attack corpora.

Integration guide →

Jailbreak detection

Rebuff

Open source. Multi-layered including a canary-token approach to detect exfiltration attempts.

Integration guide →

See also: Dashboard · Developer guide · Response headers · Compliance.