llm-stream-guardrails

llm-stream-guardrails is a zero-dependency redaction library for stripping secrets and PII before LLM output streams reach the screen or logs.

In implementations before version 0.7.9, llm-stream-guardrails held PEM private keys via the `BEGIN PRIVATE KEY` marker, but determined the end by whether any labeled `END` line appeared, rather than requiring the label to match exactly.

Due to the flawed end-marker matching logic, when a PEM private key's end marker was mistakenly written as `END CERTIFICATE`, the library masked only the header, and the base64-encoded private key body streamed through directly in plaintext, with the leaked body able to reconstruct a usable private key.

All four vulnerabilities are fixed in llm-stream-guardrails version 0.7.9, each with a regression test that fails on older versions.

After the fix, the invariant that streamed output matches whole-string output holds across roughly 320,000 fuzzing chunks.

The test suite only asserted that well-formed key blocks are masked, but no test asserted that malformed blocks do not leak, so the vulnerability remained even while all tests passed.

In streaming, a valid IBAN immediately following a JSON quote was masked during whole-string filtering, but during streaming the content was released in chunks, causing the streamed output to differ from the whole-string output.

The heuristic llm-stream-guardrails previously used to skip documentation placeholders was: as long as the value contains four identical consecutive characters it triggers, causing a real credential that happened to contain four consecutive characters to be let through.

llm-stream-guardrails' previous ASCII-based detectors could be bypassed by full-width digits or invisible separators in values, causing real sensitive values containing these characters to go unmasked.