I red-teamed my own LLM security gateway in four passes. Here's every gap I found.

I build a security gateway for LLM traffic. It sits in front of the model as a transparent OpenAI-compatible proxy — one env var, OPENAI_BASE_URL — and scans every request (and response) for leaked secrets, PII, jailbreaks, prompt injection, and exfiltration attempts. It blocks or forwards. No database, no telemetry, no model in the loop. Just deterministic pattern detection on the hot path.

The honest thing to say up front: deterministic pattern detection is not a guarantee. It raises the cost of an attack; it does not end the game. Simon Willison has been right about this for years — you can't filter your way out of prompt injection, the fix is architecture. A regex layer is a bar-raiser, not a solution, and anyone who tells you otherwise is selling something.

So instead of writing another launch post about how great my thing is, I did the opposite. I spent four sessions trying to get secrets and jailbreaks past my own gateway, fixing what slipped, and — this is the part that actually matters — making sure each fix didn't start blocking legitimate traffic.

Here's the whole thing, gaps and all.

The method