DEV Community

Cover image for How I Built a Zero-Trust AI Prompt Proxy in n8n to Stop Source Code Leaks
Ruesch Manny
Ruesch Manny

Posted on

How I Built a Zero-Trust AI Prompt Proxy in n8n to Stop Source Code Leaks

#n8n #security #ai #architecture

⚡ TL;DR — Ready-to-Deploy Automation Blueprints:

If your engineering team uses cloud-based AI coding assistants (like GitHub Copilot, ChatGPT, or Claude), you are likely leaking proprietary source code, internal IPs, and sensitive credentials to third-party servers.

For many enterprise engineering teams, InfoSec’s response is simple: Disable the AI tools entirely.

But taking away AI assistants cripples developer velocity. The middle ground? A secure, self-hosted proxy that automatically redacts sensitive data before it leaves your infrastructure.

In this guide, I'll show you how to build an Enterprise AI Prompt Sanitizer and Secure Routing Engine directly in n8n.

1. The Bottleneck: Why Commercial DLP for AI is Broken

Commercial Data Loss Prevention (DLP) proxies for LLMs are overpriced, opaque, and brittle. Most enterprise solutions charge exorbitant per-seat licenses, lock you into their ecosystem, and still fail at basic edge cases.

When you rely on a SaaS DLP:

  • High Latency: Your prompt travels to a 3rd party DLP, then to the LLM, then back.
  • Blind Trust: You are trading trusting OpenAI with trusting a random DLP startup.
  • Inflexibility: You can't easily add custom redaction rules for your specific internal microservice nomenclature.

By using n8n, you can host the proxy on your own VPC, write custom JavaScript/Python redaction logic, and route requests dynamically based on the payload's sensitivity.

2. The Architecture

This pipeline acts as a drop-in replacement for standard AI endpoints (e.g., overriding the OPENAI_BASE_URL).

Here is the step-by-step execution flow:

  1. Drop-in API Webhook: n8n listens on a Webhook node configured to accept POST /v1/chat/completions.
  2. Sanitization Engine: A Code node runs regex and entropy checks to detect and mask API keys, PII, and internal secrets.
  3. Dynamic Routing Switch: If the prompt contains highly sensitive proprietary code (even after sanitization), it routes to an air-gapped local model (like Llama 3 via Ollama). Otherwise, it passes to the faster cloud API (GPT-4o / Claude 3.5).
  4. Immutable Audit Logging: The original prompt, the sanitized prompt, and the routing decision are logged to a secure Postgres database or ElasticSearch index.
  5. Response Proxy: The LLM's response is passed back to the client seamlessly via a Webhook Response node.

3. The Code & Logic: Credential Redaction

The core of this workflow is the Sanitization node. In n8n, we use a Code Node (JavaScript) to intercept the messages array from the API payload and scrub it.

Here is a simplified version of the redaction logic you can drop directly into your n8n canvas:

// n8n Code Node: Automated Credential & PII Redaction
const items = $input.all();
const AWS_REGEX = /AKIA[0-9A-Z]{16}/g;
const OPENAI_REGEX = /sk-[a-zA-Z0-9]{48}/g;
const EMAIL_REGEX = /[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}/g;

function sanitizeText(text) {
  if (!text) return text;
  return text
    .replace(AWS_REGEX, '[REDACTED_AWS_KEY]')
    .replace(OPENAI_REGEX, '[REDACTED_OPENAI_KEY]')
    .replace(EMAIL_REGEX, '[REDACTED_EMAIL]');
}

for (let item of items) {
  let body = item.json.body;
  let hasSensitiveData = false;

  // Iterate through chat messages
  if (body.messages && Array.isArray(body.messages)) {
    body.messages = body.messages.map(msg => {
      let originalContent = msg.content;
      msg.content = sanitizeText(originalContent);

      if (originalContent !== msg.content) {
        hasSensitiveData = true;
      }
      return msg;
    });
  }

  // Tag for the routing node
  item.json.hasSensitiveData = hasSensitiveData;
  item.json.sanitizedBody = body;
}

return items;
Enter fullscreen mode Exit fullscreen mode

Pro-tip: For more advanced PII redaction (like detecting credit cards, internal server names, or physical addresses), you can pass the prompt to a local Python microservice running Microsoft Presidio before sending it to the LLM.

4. Deployment & Performance

Handling AI proxy requests requires strict attention to performance and reliability.

  • Handling Timeouts: Standard n8n webhooks can time out if the LLM takes too long. Ensure your reverse proxy (Nginx/Traefik) in front of n8n has a high timeout setting (e.g., proxy_read_timeout 120s;). For heavy workloads, consider implementing streaming responses instead of batching.
  • Rate Limits & Fallbacks: Use n8n's built-in Error Trigger nodes. If OpenAI rate-limits your request, the workflow can automatically fallback to Anthropic or an internal Ollama instance to ensure uninterrupted service.
  • Audit Routing & Alerts: Instead of just dropping logs into a database, you can route high-severity events automatically. For example, if a developer accidentally pastes a production database password into Copilot, the workflow can trigger an immediate incident ticket in your CRM/Jira or ping a dedicated Slack #security-alerts channel.

5. Conclusion & Ready-to-Use Workflow

Protecting your intellectual property shouldn't mean disabling the tools your developers love. By deploying an n8n-based proxy, you retain complete control over your data, maintain zero-trust security, and get an immutable audit trail of every prompt.

You can build this entire pipeline yourself using the architecture and code snippets provided above.

Or, you can save 15+ hours of building, debugging regex, and configuring API drop-in compatibility.

I've packaged this exact architecture into a production-ready n8n template. It includes the advanced redaction logic, the local-to-cloud dynamic routing switch, and test fixtures to ensure your API keys never leak.

Get the turnkey workflow here:

Drop a comment below if you have any questions on setting up local LLM routing or expanding the regex rules!

🛠️ D'autres outils MR Studio qui pourraient vous intéresser :

Top comments (0)