1. Define the trust boundary
Treat user-authored and externally retrieved text from websites, email, documents, RAG, APIs and tools as untrusted. External data must not be able to replace privileged instructions.
2. Compare rendered and raw content
Look for invisible text, bidirectional controls, HTML comments, hidden styles and encoded blocks. Content a person cannot see may still enter model context.
3. Remove secrets and personal data
Before sending a prompt, remove credentials, tokens, identity numbers, email, phone and payment data that are not strictly required. Rotate any real secret that was already exposed.
4. Restrict tools and destinations
Allow only the tools, parameters and destinations required for the task. Payments, deletion, publishing, email and permission changes need immediate human confirmation.
5. Read the result conservatively
A deterministic checker recognizes known patterns but cannot guarantee that text is safe. Novel, semantic, visual or deeply obfuscated injection can evade rules.
Frequently asked questions
H/M Blindspot · hogarmas.net
Does a clean result mean the prompt is safe?
No. It only means no configured rule matched. The result is not a security certification.
Is the text sent to a server or another model?
No. Prompt Firewall analyzes text in the browser and reports omit both raw and redacted input text.
Does the redacted copy remove prompt injection?
No. It replaces selected secrets, personal data and invisible controls, but semantic instructions can remain.