-
-
Main interface
-
Scan report - part 1
-
Scan report -part 2 and scan history
Inspiration
AI agents increasingly rely on public web pages as context, but those pages may contain instructions intended for the agent rather than the person reading them. These instructions can be hidden in HTML comments, metadata, accessibility attributes, or visually concealed text. I built PromptSentry to provide developers with an explainable screening step before allowing an AI agent to trust web content.
How I built it
I built PromptSentry with .NET 10, C#, Blazor Server, Bootstrap, EF Core, Azure SQL, and Azure App Service. Its deterministic scanner safely fetches one public page, validates DNS and redirect destinations, limits response time and size, extracts concealed content, and applies explicit prompt-injection rules. GPT-5.6 provides an optional evidence review through the Azure OpenAI Responses API. It receives only redacted finding metadata, never full page HTML, and cannot override the deterministic score. Azure SQL stores limited report metadata and supports shared usage and cost limits. I used Codex with GPT-5.6 throughout development to structure the application, implement and test its security boundaries, diagnose Azure integration issues, create database migrations, improve the UI, and verify Release builds.
Challenges
The hardest challenge was preventing server-side request forgery. URL validation alone was insufficient because DNS results and redirect destinations can change. I designed the fetcher to revalidate every redirect and resolve addresses again when opening the network connection. Another challenge was enforcing usage limits atomically across multiple App Service instances. EF Core’s retrying SQL execution strategy required the transaction to be executed as one retriable unit. I also had to make Azure OpenAI optional and failure-safe so that configuration errors, timeouts, or exhausted AI capacity never prevent the deterministic report from being returned.
What I learned
I learned that securing AI inputs requires more than adding another model. Deterministic controls provide a reproducible foundation, while AI is most useful as a bounded explanation layer. I also learned to treat every piece of remote content—including metadata and element attributes—as untrusted, minimize what is stored or sent to external services, and design optional cloud integrations to fail safely. The project reinforced how network security, privacy, cost control, and user experience must be designed together rather than added independently.