Security Architecture & DPA Whitepaper
Engineered for CISOs, Security Engineers, and Enterprise IT Procurement Teams.
1. In-RAM Secret Redaction Engine
Before any target bundle (.zip or JSON) is synthesized, PromptShift scans all file contents against our high-performance regular expression filter to detect and neutralize leaked secrets:
• OpenAI Keys (sk-[a-zA-Z0-9]{20,}) -> [REDACTED_API_KEY]
• Anthropic Keys (sk-ant-[a-zA-Z0-9_-]{20,}) -> [REDACTED_API_KEY]
• GitHub Tokens (ghp_[a-zA-Z0-9]{36}) -> [REDACTED_API_KEY]
• AWS Access Keys (AKIA[0-9A-Z]{16}) -> [REDACTED_API_KEY]
• Private RSA / SSH Keys (-----BEGIN RSA PRIVATE KEY-----) -> [REDACTED_KEY]
2. Binary & Magic Byte Blocking (MZ Header Guard)
PromptShift strictly enforces text/markdown-only processing for agent prompts and configurations. Any file beginning with binary MZ executables (Windows PE), ELF binaries, or Mach-O magic bytes is immediately blocked and rejected in memory, mitigating payload execution or Trojan injection.
3. Zip Slip & Zip Bomb Defenses
All ZIP unpacking routines apply strict path sanitization. Directory traversal characters (../) are stripped to prevent file writes outside sandbox limits. Decompression ratios are constrained to prevent memory exhaustion (Zip Bomb mitigation).
4. GDPR Article 28 Data Processing Agreement (DPA)
PromptShift provides standard contractual clauses (SCC) and automated DPA compliance for enterprise teams. Because zero repository code is ever persisted to cloud disks, your risk surface remains at absolute zero. For a custom signed DPA document, please reach out to [email protected].