DLP for LLM API traffic: scanning outbound requests for secrets

When an AI agent calls a model API, the request body is a summary of everything it has read — including, sometimes, things it shouldn’t have read. A key pasted into a config file years ago, a token that leaked into a debug log, a teammate’s credential that never went through your secret store: any of them can end up inside a prompt, and from there inside a request to a third-party endpoint.

Injection and sanitization handle secrets the agent uses. Outbound DLP is the safety net for everything else: scan the traffic on the way out, and mask anything that looks like a secret before it leaves the machine.

What to scan for

The interesting part of DLP isn’t the proxy — it’s knowing what a secret looks like. Three signal types, in increasing cost:

1. Known values. Exact strings from your credential store. Zero false positives, but blind to secrets you don’t know about.

2. Format patterns. API keys have recognizable shapes: sk- prefixes, AKIA AWS keys, JWTs starting with eyJ, private key blocks. This is where rule sets like gitleaks’ come in — hundreds of battle-tested formats for real-world key types.

3. Entropy. The final filter: a string that matches a key format also has to be high-entropy enough to actually be a key. Documentation placeholders like <redacted> or your-api-key-here match formats but fail entropy — that’s how you avoid redacting half your legitimate traffic.

The pipeline order matters: cheap keyword pre-filter first, format regexes second, entropy last — so the expensive checks only run on suspicious lines.

Detect first, then mask

A DLP layer with two modes is the sane rollout path. In log mode, pattern hits are counted and recorded but the request passes through unchanged — you learn what the rules fire on without breaking anything. In mask mode, matches are redacted in place before the request leaves.

The operational pattern: run in log mode for a week, review the hits, disable the rules that produce noise (the generic catch-all rules usually top the list), then flip to mask.

Configuration that doesn’t require a restart

Rules and modes are useless if changing them means redeploying a proxy. A DLP layer for agents should reload configuration on a signal (SIGHUP or a periodic refresh), and swap the pattern set atomically — a bad rule file fails the reload and keeps the previous state, so the traffic filter never silently stops working because of a typo.

Fitting it into an agent setup

The DLP proxy sits in front of any OpenAI-compatible endpoint. The agent keeps calling the same URL; the proxy scans and masks on the way through — no config change in the agent, no client-side SDK.

trustless implements this as trustless serve: a zero-dependency Go binary with an integrated DLP layer — 40 gitleaks-derived rules (keyword → RE2 → entropy), pattern_mode log/mask, per-rule disabling, and hot reload. The pattern layer design is covered in detail in the DLP documentation.

The test for whether your setup needs this: look at what your agent has actually sent to model APIs in the last week. If you can’t rule out a secret being in there, you already know the answer.