3 Commits

Author	SHA1	Message	Date
didericis-claude	726713d081	feat(egress): implement PRD 0053 — DLP addon with Gateway API matches ... Replace path_allowlist with Gateway API HTTPRoute match vocabulary (paths, methods, headers with AND/OR semantics) and add DLP scanning to the egress proxy: - Token pattern detection (AWS, GitHub, Anthropic, OpenAI, Stripe, JWT) - Known secret detection (EGRESS_TOKEN_* with base64/URL/hex variants) - Naive prompt injection detection (disclosure + credential, jailbreak) - Per-route DLP configuration via manifest dlp block - Inbound response scanning with block/warn severity Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>	2026-06-05 19:53:23 +00:00
didericis-claude	5265e25f9b	docs: address PR #196 review; update research decisions and PRD ... Research doc: close open questions with decisions from review — hard cutover on path_allowlist, drop glob (regex sufficient), stick with Gateway API OR semantics for headers, case-insensitive method names. PRD 0053: adopt Gateway API HTTPRoute match vocabulary (paths, methods, headers) as the route schema replacement for path_allowlist. Add MatchEntry / PathMatch / HeaderMatch types to EgressRoute design; cite the route matching research doc; fold match restructure into chunk 1 alongside the dlp block.	2026-06-05 00:52:57 +00:00
didericis-claude	f145203eee	docs: PRD 0053 — egress DLP addon (token, secret, injection detection) ... Adds the product requirements document for replacing pipelock's DLP capability with a per-route mitmproxy addon. Covers three implementation chunks: token-pattern detection, known-secret detection, and naive prompt injection scanning. References the research in PR #192 and issue #195.	2026-06-05 00:34:55 +00:00