Honest security posture. No marketing fluff.
We cover 5 of 10 OWASP LLM Top 10 risks at the gateway layer. We tell you exactly which ones - and why the others are out of scope.
5/10 covered at the gateway layer.
Some OWASP LLM risks are training-time or agent-design concerns - a request proxy cannot address them. We cover what a gateway can cover, and say so plainly for the rest.
Pattern-based + heuristic detection. Block in-path before model sees prompt.
Response filter strips dangerous patterns before returning to caller.
Out of scope - training-time concern, not addressable by inference proxy.
Per-key token + request rate limiting enforced in-path.
Out of scope - model supply chain, not request routing.
PII filter redacts sensitive data before it reaches the model.
Application-architecture concern; not addressable at gateway layer.
Agent-design concern; partially addressable with custom policy rules.
UX/process concern; outside scope of a request gateway.
API key isolation and rate limiting reduce bulk extraction risk.
Never trust. Always verify.
Every request - regardless of origin or prior history - is authenticated and evaluated against the full policy stack before forwarding. No IP allowlisting, no session-level trust.
With up to 70% of developers admitting to pasting proprietary code and PII into external systems, and the average Shadow AI data breach costing $670,000 in regulatory fines, unmonitored AI access is an unacceptable risk. Deploying Autrace as your Shadow AI governance proxy enforces an active OWASP LLM01 gateway proxy and a real-time PII redaction LLM gateway 2026 check on every request before it leaves your VPC.
What we store. What we don't.
Where we stand today.
Responsible disclosure. Safe harbour.
Found a security issue? Email security@autraceai.com. We acknowledge within 24 hours. Patch SLAs by CVSS severity:
Good-faith security research - with no intent to disrupt service or access customer data - will not result in legal action. We will credit you in the advisory unless you prefer otherwise.
Report a vulnerability →