We added a PII gate before the LLM call: SSNs get a 400 before ever reaching the model
Scholeristical · reddit · 2026-09-09
A privacy-engineering writeup: the product sends user-pasted text to an LLM, and a review asked the obvious question — what stops someone from pasting in an SSN? Nothing, until this week.
- Server-side pattern matching rejects common SSN formats with a 400 before the API call fires; a client-side mirror gives instant feedback.
- Deliberately scoped to SSNs only — a broad PII scrubber would break a tool whose input relies on personal context.
- Also added country gating via the edge-provided IP-country header, rejecting non-US traffic since international data handling isn't ready.
Key takeaway: much of "responsible AI" work is deciding what not to send upstream, screening hard before the call rather than constraining the model after the fact.
More from coding & agent
- Dev calls for ChatGPT to bill paid MCP usage directly as x402 gains momentum — kleffew94 · 2026-09-09
- OpenAI rolls out Astra model to all Codex and ChatGPT Work users — craigsdennis · 2026-09-09
- Dev uses AI to model vintage change machines in Blender for his game — AIandDesign · 2026-09-09
- Reading video frame-by-frame in Codex with ffmpeg: a clever workflow tip — _AustinCalvert_ · 2026-09-09
- Gemini CLI v0.60.0-preview hardens sandboxing, OAuth and path security — gemini-cli-robot · 2026-09-09
- W&B's research agent ARIA impresses: custom experiment analysis with auto-generated Plotly charts — _ScottCondron · 2026-09-09