With the explosion of OpenAI and Anthropic SDKs, raw customer records, SSNs, credit cards, and patient health notes are frequently sent over the wire in plain text. EgressProof audits all HTTP clients, interceptors, and prompt synthesizers with zero dependencies.
Select a sample architecture scenario below or paste custom code to evaluate outbound destinations, trust boundaries, and unredacted PII exposure in real time.
Integrate EgressProof into your existing CI/CD pipelines, local development, or Docker manifests without changing application runtime logic.
Run immediate diagnostic egress scan on local source files:
npx egressproof scan ./src
Enforce pull request CI gate with minimum score threshold of 95:
npx egressproof check --min-score 95 --fail-on-leak
Add to .github/workflows/egress-boundary.yml:
name: EgressProof Data Boundary Gate
on: [push, pull_request]
jobs:
egress-audit:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- name: Verify Outbound Egress & Redactor Boundaries
uses: subash-thiruppathy/EgressProof@v1
with:
scan-path: '.'
min-score: '90'
fail-on-leak: 'true'Embed into your testing suite or pre-commit verification scripts:
import { createEgressProofEngine } from 'egressproof';
const engine = createEgressProofEngine();
const results = await engine.scanDirectory('./src');
if (!results.summary.zeroLeakMaintained) {
throw new Error(`Data Egress Hazard: Detected ${results.summary.piiLeaks} unmasked customer PII leaks!`);
}Run via containerized zero-dependency runner:
docker run --rm -v $(pwd):/app -w /app node:20 npx egressproof check --min-score 90
Display real-time proof of zero customer PII leaks and HIPAA/GDPR compliance directly on your repository README and status dashboard.
Enterprise security teams cannot rely on manual code reviews. EgressProof produces verifiable non-repudiation packs with SHA-256 digital seals for internal and external auditors.
§ 164.312(e)(1) & § 164.312(a)(2)(iv)
Mandates technical security measures guarding against unauthorized exposure of electronic protected health information (ePHI) across network communications and external AI services without a Business Associate Agreement (BAA).
Article 32 & Article 9
Requires continuous data minimization and explicit technical barriers preventing unredacted personal identifiers or biometric customer records from egressing to unvetted third-party multi-tenant cloud providers.
Criteria CC6.7 Data Transmission
Audits data transmission to external entities, verifying that data boundaries are strictly maintained, sensitive headers are stripped, and request interceptors scrub error traces before APM dispatch.
Start for free locally, upgrade for automated CI/CD gating, dynamic SVG trust badges, and HIPAA § 164.312 auditor compliance packs.
Essential CLI scanning for solo developers verifying local code before committing.
Automated pull request gating to prevent customer PII leaks in team code reviews.
Comprehensive fleet-wide LLM prompt redactor validation & standalone HTML reporting.
HIPAA § 164.312 & GDPR Art 32 certified evidence bundle with SHA-256 seal.
Everything you need to know about EgressProof static verification and offline licensing.
No. EgressProof is 100% static AST inspection. It never runs inline proxy software, decrypts TLS packets, or requires agent daemon installation on production hosts. It prevents sensitive data egress before code is merged.
EgressProof traverses prompt templates, string interpolations (such as template literals or Python f-strings), and method invocation arguments to OpenAI, Anthropic, or Google GenAI SDKs. It asserts that customer identity variables (SSNs, medical records, diagnosis, card numbers) are filtered through verified redaction wrappers.
All commercial licenses use cryptographically signed HMAC-SHA256 tokens (gp_lic_...). The CLI and GitHub Action validate licenses completely offline in air-gapped CI environments without ever phoning home.