Secrets in your responses
Catch API keys, private keys, database URLs, and sensitive fields in outgoing responses. Septr can redact the value before the client sees it and records the evidence for review.
Runtime security middleware
Runtime security for
AI-generated apps.
AI-generated apps move fast. Security checks usually arrive later — after a secret reaches a bundle, a route ships without authorization, or an AI endpoint starts burning through quota. Septr finds those failures before they become an incident, then protects the app at runtime.
No signup · Public URL · Results in ~30 seconds
$
npm install septr
In-process · In-memory · Fail-open — protection that does not become an outage.
── inbound ───────────────────────────────
GET /api/users/8812 Bearer eyJ…
✕ BOLA jwt.sub=4417 ≠ :id=8812 → 403 (1.2ms)
GET /api/profile
⚠ SECRETS sk_live_* matched → scrubbed
✓ 200 "stripe_secret_key":"[REDACTED]" (0.8ms)
POST /api/chat "ignore all previous…"
✕ PROMPT-INJECTION → blocked (0.6ms)
3 req · 2 blocked · 1 scrubbed · avg 0.9ms
12
Engines
22
Secret patterns
<5ms
p50 overhead
8
Frameworks
The actual problem
Ship quickly without shipping the obvious risks
AI-generated code is productive. It can also create a plausible route, response, or integration before anyone has checked its security boundary.
Routes that forgot to ask who's calling
Compare identity claims with route and body identifiers, flag missing authentication, and stop the classic “change the ID and read someone else's record” failure.
Endpoints priced on your card
Put limits around expensive routes and watch provider quota signals. A public AI endpoint should not be an unlimited charge against your card.
Evidence from the field
The dangerous part is what reaches production.
Septr Research studies AI-generated source code and public deployments with the same rules engine. The pattern is clear: a repository finding becomes a real incident when a credential is compiled into a client bundle.
Read the research1,248live deployments probed
11critical API keys found in bundles
4Supabase service-role keys exposed
0/269false positives on verified JWTs
The engines
Twelve engines. One runtime layer.
Each engine evaluates requests and responses in memory, then records the detection, evidence, latency, and verdict for review.
01
Secrets
22 patterns — OpenAI, Stripe, AWS, GitHub, JWT, private keys, DB URIs — caught in response bodies before they ship.
02
BOLA / IDOR
JWT sub vs route :id. Cross-tenant access is blocked with a 403.
03
PII scrubber
password_hash, ssn, stripe_secret_key → [REDACTED]. New field shapes trigger schema-drift alerts.
04
SQLi
14 patterns — UNION SELECT, OR 1=1, WAITFOR DELAY — in bodies and query strings.
05
XSS
17 patterns — <script>, onerror, javascript:, event handlers — neutralized on input.
06
Prompt injection
24 jailbreak patterns — DAN, role overrides, system-prompt extraction, tool-call manipulation.
07
SSRF
Blocks internal ranges and 169.254.169.254 metadata fetches. file:// and gopher:// don't pass either.
08
Rate limiting
Sliding window per IP and route. Static assets bypassed automatically.
09
AI quota guard
Detects 429s and quota exhaustion in provider responses — before your bill does.
10
Missing auth
Routes without a Bearer token get flagged. Knows /health and /login are supposed to be public.
11
Logic tamper
Negative pricing, 100%+ discounts, privilege fields in request bodies — caught before your checkout is.
12
Cross-tenant leaks
Tenant-aware response scans. If tenant A's rows end up in tenant B's payload, you'll know first.
How it works
Install once. Keep your runtime accountable.
1
Wrap your app
One import, one line. Express, Next.js, Hono, Fastify, Flask, FastAPI, Gin, net/http.
import { createSeptr } from "septr/express"
app.use(createSeptr({ apiKey: process.env.SEPTR_API_KEY }))
2
Every request, proofread
In-process and in-memory. Static assets skip the pipeline. Telemetry buffers async and flushes in batches — the hot path never waits.
3
Fail open, always
The entire pipeline is wrapped in try/catch. If Septr ever trips, it steps aside — your app keeps serving traffic. Verified under sustained load: zero memory growth, zero unhandled rejections.
4
Evidence you can review
Every detection lands in the dashboard as a per-engine incident — with latency, pattern, and verdict. That's your SOC 2 evidence, collected automatically while you sleep.
The dashboard
Proof, per engine
secretsverified · 0.8ms
bola / idorverified · 1.2ms
pii-scrubberverified · 0.4ms
prompt-injection2 incidents
rate-limitverified
ssrfverified · 0.3ms
Turn runtime signals into evidence.
Each engine reports its verification state, latency, pattern, and verdict. Security teams get an incident history they can review; developers get a concrete route and payload to fix.
Your AI built the feature.
Septr checks the boundary.
Scan a public deployment for free, or add runtime protection with one middleware import.
$
npm install septr