NebiusGuard — Streaming Security for Nemotron

Inspiration

Model-powered applications need explicit boundaries between a generated response and a consequential tool action. NebiusGuard explores those boundaries in a small, reproducible Node.js prototype.

What it does

NebiusGuard is a JavaScript client library and deterministic demonstration, not a deployed multi-tenant service. It checks a small set of known prompt-injection phrases, validates allowed tool names and static arguments, inspects supported credential patterns in streamed content, caches matching successful completions, and records a hash-linked in-memory audit log.

The Token Factory client implements authenticated model discovery, non-streaming chat completions and SSE chat completions at the current Nebius endpoint. The live demo selects an NVIDIA model from the account-visible catalog rather than assuming a model ID.

How we built it

The implementation uses Node.js ESM, native fetch/Web Streams, AbortController and node:crypto with no third-party runtime packages. Automated tests use injected HTTP transports and synthetic data to cover authentication, response bounds, streaming completion, cache isolation and security-boundary cases. Run npm test and npm run demo from the public repository to reproduce the offline evidence.

Live provider verification

On October 28, an authenticated Token Factory run discovered 30 account-visible models and selected nvidia/NVIDIA-Nemotron-3-Nano-30B-A3B. A real streamed answer passed through NebiusGuard; the provider was nebius-token-factory, the audit chain verified, and two audit events were recorded. Non-secret evidence is preserved in docs/live-verification-2026-10-28.md in the repository.

This is one integration smoke test, not an accuracy evaluation or a comparative latency, throughput, cost or customer benchmark. The public under-three-minute demo is available at https://youtu.be/SOOPTilt-HE. It clearly separates replayed evidence from the captured authenticated run and synthetic security cases.

Challenges and learning

Important failure modes include private addresses hidden by alternate URL representations, credentials split across stream chunks, oversized responses without a Content-Length header, and partial SSE output ending before the terminal marker. The project uses focused regression tests to make these boundaries reviewable.

Limits

Static URL validation is not DNS pinning or redirect enforcement; an executor must recheck resolved addresses and redirects. The library does not execute tools and does not implement comprehensive per-tool JSON schemas. Pattern checks cannot guarantee that all prompt attacks or secrets are detected. The audit log is mutable in-memory state with hash-chain verification, not an immutable or externally anchored ledger. No zero-latency or production-readiness guarantee is made.

Repository and demo

Source and reproducible instructions: https://github.com/sidsri14/nebiusguard

The versioned release includes the original MP4, captions and media-verification record: https://github.com/sidsri14/nebiusguard/releases/tag/v0.2.0-hackathon . The current implementation passes 29 automated tests; Node 20, 22 and 24 CI jobs pass on Windows and Linux.

Built With

• api
• javascript
• node.js
• security