Poterne

The quiet security gateway for every LLM.

Comment

Inspiration

AI adoption is mainstream. Stanford’s AI Index reports that 78% of organizations used AI in 2024. But every new model integration—whether Chatgpt, Gemini, Claude, or a custom OpenAI endpoint—expands your active attack surface.

We saw a fragmented security landscape: teams hard-code prompt injection filtering for one provider, PII redaction for another, and completely forget about tool-call safety. A standard data breach costs millions, and LLMs introduce unique failure modes: prompt injection, system-prompt leaks, exposed API keys, PII leaks, and destructive tool calls (like SQL injection or email exfiltration).

We built Poterne because security should not be an afterthought per provider—it should be a unified, provider-agnostic gate. We wanted to create a "secure by default" control plane that treats security incidents not as one-off alerts, but as permanent regression tests.

What it does

Poterne is the quiet security gateway for every LLM.

Today, Poterne sits between your application and its configured model provider through an OpenAI-compatible gateway. Its adapter architecture is designed to extend the same policy layer across providers. By simply changing your client's baseURL to Poterne, your traffic now passes through a unified policy layer. The gateway:

  • Blocks Prompt Injections & Jailbreaks before they reach your provider.
  • Redacts PII and Secrets (API keys, emails, phone numbers) while preserving context for the model.
  • Scans Outputs to catch accidental system-prompt leaks or exposed credentials.
  • Scans Tool Calls to detect destructive SQL, external webhooks, or shell commands before execution.

For judges, we built a Test Panel that issues a one-hour, IP-bound credential directly in the dashboard—no need to request a key. Copy the curl command, run three bounded 100-token requests, and the key re-masks after 15 seconds.

The crown jewel is Promote to Eval. A blocked incident converts instantly into a safe synthetic fixture, a runnable Vitest regression test, and a Codex-ready patch prompt. This turns real-world attacks into permanent defenses. Poterne stores only safe audit metadata (threat types, risk scores, hashes, redacted previews). Raw prompts and provider responses are never persisted.

How we built it

We built Poterne entirely for OpenAI Build Week 2026 using the full power of Codex and GPT-5.6.

  • Architecture & Design: We used GPT-5.5 to design the microservices architecture and data privacy model (ensuring zero raw prompt storage).
  • Implementation: We used Codex 5.5 (Extra High) for the initial heavy lifting (building the Lambda gateways, React dashboard, and provider adapters). When Codex 5.6 Terra became available, we used it for the final, critical hardening—turning the Policy Studio buttons into real server-side deterministic checks, adding the safe synthetic incident fallback, and verifying the generated eval schemas.

Technical Stack:

  • Frontend: React, Vite, TypeScript, custom CSS.
  • Backend: AWS Lambda (Gateway, Control API), DynamoDB, API Gateway WebSocket, CloudFront.
  • Infrastructure: Terraform (100% AWS provisioning).
  • Monorepo: pnpm workspaces with Node.js 22.
  • Testing: Vitest for unit and regression evals (pnpm eval:generated).
  • Security Engine: Deterministic scanners for Input, Output, and Tool firewall.

We designed a provider-agnostic adapter layer, allowing the same security policies to work seamlessly across DeepSeek (runtime), OpenRouter (live synthetic replay), and Gemini (sandbox). We used HMAC-fingerprinting to enforce a strict 3-action-per-IP daily quota for the public demo without ever storing raw IP addresses.

Challenges we ran into

  • Streaming SSE Firewalling: Inspecting output for system-prompt leaks in streaming chunks is significantly harder than for non-streaming responses. We successfully implemented non-streaming output checks and scoped streaming as a defined limitation for future work.
  • Data Privacy vs. Observability: Building a security tool that provides rich, actionable alerts (threat types, scores, redacted previews) while strictly never persisting the raw prompt or response required careful architectural discipline. We had to ensure redaction happened at the edge.
  • Provider Parity: Ensuring the "Replay Lab" behaved deterministically across DeepSeek, OpenRouter, and Gemini with synthetic data, while keeping live-synthetic probes under a strict global budget, required building a separate "sandbox" execution mode alongside the "live" mode.
  • Codex Context Management: Managing a large monorepo (apps for gateway, control-api, dashboard, and packages for security, adapters, shared) with Codex required strategic prompting. We used docs/ai/CODEX_PROOF.md and worklogs to keep the AI context coherent across sessions.

Accomplishments that we're proud of

  • "Promote to Eval": This unique engineering loop is our proudest achievement. We turned threat detection into a CI/CD feedback loop. A blocked injection now generates a real Vitest test and a JSON fixture, ensuring that specific attack vector can never be reintroduced.
  • True Provider-Agnosticism: We proved our security policy remains 100% independent of the underlying LLM. The same Poterne gateway protects DeepSeek runtime, OpenRouter synthetics, and Gemini sandbox without changing a single line of policy code.
  • Zero Raw Storage: We successfully built an enterprise-grade security product that requires zero trust in its storage layer. Judges can inspect events without ever risking exposure of sensitive user data.
  • Codex-First Development: We built the entire project (gateway, dashboard, control API, Terraform scripts) using Codex 5.5 (Extra High) and 5.6 Terra . The local suite proves it: eval:generated passes flawlessly.

What we learned

  • OpenAI API Nuances: We gained deep expertise in the OpenAI-compatible API shape, including the subtle differences between x-poterne-api-key headers and standard Authorization: Bearer tokens, and how to handle streaming gracefully.
  • Security Engineering in the LLM Era: We learned that securing LLMs isn't just about filtering bad words; it's about structural integrity—checking tool JSON for SQL injection, scanning outputs for accidental SYSTEM_PROMPT leaks, and managing risk scores dynamically.
  • Infrastructure as Code Discipline: Using Terraform to deploy and teardown the entire dev/demo stacks (scripts/destroy-demo.sh) taught us how to build "destroy-friendly" hackathon infrastructure that avoids surprise AWS bills.
  • Codex Workflow Integration: We learned how to effectively use Codex for large-scale refactoring (like the Policy Studio scanner integration) and how to keep a massive monorepo organized with Codex's assistance.

What's next for Poterne

We built Poterne as a powerful prototype for OpenAI Build Week, but we see a clear path to production.

  • Rolling Streaming Firewall: Implement incremental scanning for SSE streaming chunks to catch leaks in real-time during generation, not just at the end.
  • BYOK (Bring Your Own Key) Center: Expand the "planned" provider support (OpenAI, Claude, Mistral) into a full Secrets Center where customers can manage their own provider keys via the dashboard.
  • Gateway-to-WebSocket Push: Replace the current polling mechanism in the dashboard with true event fanout via WebSockets for real-time threat notifications.
  • Signed Audit Packages: Extend the "Download safe report" functionality into cryptographic signed packages that enterprises can use for compliance (SOC2, GDPR).
  • Policy as Code Editor: Build a rich UI in Policy Studio that allows users to write and test custom regex/heuristic rules and immediately see the impact via the Replay Lab.
  • Hardened Production Certification: Move beyond the hackathon demo into a validated, enterprise-ready, open-core security solution.

Every enterprise LLM application needs a gate. This gate is Poterne.

Built With

  • ai-security
  • amazon-web-services
  • api-gateway
  • aws-lambda
  • codex
  • developer-tools
  • devops
  • dynamodb
  • gpt-5.6
  • gpt-5.6-terra
  • hackathon
  • llm-gateway
  • llm-security
  • monorepo
  • open-source
  • openai
  • openai-build-week
  • prompt-injection
  • react
  • security-gateway
  • terraform
  • typescript
  • vite
  • vitest
Share this project:

Updates