Building a sub-millisecond LLM security proxy in Go — lessons from 62 adversarial vectors

TL;DR — I spent 6 months building builds a single deterministic finite automaton at startup from all patterns at once. Matching is O(M + matches) — linear in input length regardless of how many patterns you have.

I used .

Performance — the honest numbers

I benchmarked with , AGPL-3.0 (open-core; enterprise features under separate commercial license).

I'm especially interested in contributions to the adversarial corpus — particularly non-English injection patterns. If you find a bypass, please report it via as a pair programmer. Architecture decisions, security model, scanner design, and the adversarial corpus are mine — every line is reviewed and tested. If you've been curious about LLM-assisted development for a security-critical codebase, the lesson I'd share is: AI is excellent at boilerplate (handler scaffolding, test fixtures, documentation) and weak at threat modeling. Use it for the former, not the latter.

If this post was useful, I'd appreciate a star on github.com/yatuk/tamga — it helps other security teams discover the project. Questions, criticism, and bypass reports all welcome in the comments.

Vollständiger Original-Bericht

Ausführliche Details, Code-Beispiele & Hersteller-Stellungnahme auf dev.to.

↗ Original-Artikel auf dev.to lesen