If you’re routing user input into an LLM without a security layer, you’re basically running a web app in 2003 without input sanitization. Prompt injection is not a theoretical threat — it’s an active attack vector, and most developers are ignoring it entirely. I got tired of waiting for someone else to solve it, so I built Sentinel.

What’s the actual threat?

Prompt injection is when an attacker embeds instructions inside user input that hijack your LLM’s behavior. There are two flavors. Direct injection is when the user themselves crafts input to override your system prompt — “Ignore all previous instructions and…” Indirect injection is when malicious instructions are embedded in content your AI reads — a webpage, a document, an email — and your agent executes them without the user even knowing. The second one is the scary one. As agentic AI workflows proliferate (think n8n pipelines, AutoGPT-style agents, AI email assistants), the attack surface explodes. Your AI isn’t just answering questions anymore — it’s taking actions.

Why existing defenses fall short

Most teams either do nothing, or bolt on a simple keyword blocklist. Neither works well. Blocklists are trivially bypassed with rephrasing, encoding, or language switching. LLMs are specifically designed to follow instructions — that’s the vulnerability and the feature. Context matters enormously — “ignore” is fine in most sentences, malicious in others. What you actually need is layered detection that understands intent, not just keywords.

How Sentinel works

Sentinel sits as a proxy in front of your LLM endpoint. Every request passes through a four-tier pipeline before it ever reaches your model. The regex layer is fast and cheap, catching the obvious stuff immediately. Embedding similarity compares input against a vector database of known injection patterns, catching rephrased variants the regex misses. Content neutralization attempts to strip or defuse suspicious instructions while preserving legitimate intent. Finally, a proprietary analysis layer makes a contextual judgment on anything that survived the first three tiers — this is where intent is evaluated, not just pattern matched. Sentinel operates at line speed and is non-blocking by default, so it won’t add meaningful latency to your stack.

Privacy by design

Request content is never stored. Your dashboard shows threat scores, actions, and metadata, but the actual payload is gone the moment it’s evaluated. Full detail logging is opt-in only, for users who want to contribute to improving detection. Nothing is retained without your explicit choice.

The architecture

FastAPI for the proxy layer, PostgreSQL for persistent threat logging, Redis for rate limiting and caching, and Nginx Proxy Manager for routing. Intentionally boring infrastructure choices — the kind that actually runs reliably at 3am without waking you up.

Who this is for

Developers exposing LLM endpoints to user input, teams building agentic workflows where the AI takes real-world actions, self-hosters who want a security layer without sending everything to a third-party API, and anyone who’s heard “prompt injection” and thought I should probably do something about that.

What defenses, if any, are you currently running in front of your AI endpoints?