AirLock 🔒

AI API Security Proxy — A reverse proxy that sits in front of LLM APIs and inspects every request through a multi-layer security pipeline before forwarding it upstream.

Client → AirLock Proxy (:8080) → Security Pipeline → Upstream API

• 🔄 Reverse Proxy — Transparently forwards requests to upstream LLM APIs
• 🛡️ Direct Injection Detection — Catches 35+ known prompt injection patterns
• 🧪 Indirect Injection Detection — Detects injections hidden in RAG/tool data
• 🔒 Context Sandboxing — Wraps untrusted external data in security boundaries
• 📊 Risk Scoring — Heuristic-based risk assessment with configurable thresholds
• 📋 Threat Event Log — In-memory event log with stats at /airlock/events
• 🧬 Obfuscation Detection — Flags encoded/obfuscated content
• 💚 Health Endpoint — Built-in health check at /airlock/health
• 🌐 CORS Support — Configurable cross-origin resource sharing
• 🔔 Webhook Alerting — Notify Slack or any HTTP endpoint on HIGH severity blocked events

• Go 1.21+

# Default upstream (https://api.openai.com)
go run ./proxy/

# Custom upstream
UPSTREAM=http://localhost:11434 go run ./proxy/

curl http://localhost:8080/airlock/health
# {"status":"ok","version":"0.1.0"}

curl http://localhost:8080/airlock/events
# {"events":[...], "stats":{"total":5,"blocked":3,"l1_hits":2,"l2_hits":3,"high":3,"medium":2}}

curl -X POST http://localhost:8080/v1/chat/completions \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer sk-your-key" \
  -d '{
    "model": "gpt-4",
    "messages": [{"role": "user", "content": "Hello!"}]
  }'

Fast, case-insensitive substring matching against 35+ patterns:

• ✅ Instruction override attempts
• ✅ Jailbreak / DAN patterns
• ✅ System prompt extraction attempts
• ✅ Role hijacking patterns
• ✅ Token/delimiter injection
• ✅ Multilingual patterns (French, Spanish)

RAG-aware indirect injection detection + data sandboxing:

• ✅ 14 RAG trigger phrase detection
• ✅ 13 indirect injection signal patterns
• ✅ Delimiter escaping (AIRLOCK tags, </system>, <|im_end|>, etc.)
• ✅ Security boundary wrapping with policy instruction
• ✅ Defense-in-depth (always sandboxes even without injection signal)

Deep structural analysis:

• ✅ Suspicious role pattern detection
• ✅ Encoded/obfuscated content detection
• ✅ JSON nesting depth analysis
• ✅ Token count estimation
• ✅ Composite risk scoring (threshold: 0.7)

MIT License — see LICENSE for details.