Skip to main content

Documentation Index

Fetch the complete documentation index at: https://docs.declaw.ai/llms.txt

Use this file to discover all available pages before exploring further.

import "github.com/declaw-ai/declaw-go"
A SecurityPolicy is passed to Create() via the WithSecurity option. It composes PII detection, injection defense, toxicity / code-security / invisible-text scanners, network policy, transformation rules, audit logging, and environment variable security into a single struct.

​
SecurityPolicy

policy := declaw.SecurityPolicy{
    PII: &declaw.PIIConfig{
        Enabled: true,
        Types:   []declaw.PIIType{declaw.PIIEmail, declaw.PIICreditCard},
        Action:  declaw.RedactionActionRedact,
    },
    InjectionDefense: &declaw.InjectionDefenseConfig{
        Enabled: true,
        Action:  declaw.InjectionActionBlock,
    },
    Audit: &declaw.AuditConfig{Enabled: true},
}

sbx, err := declaw.Create(ctx,
    declaw.WithSecurity(policy),
)
FieldTypeDescription
PII*PIIConfigPII detection and redaction
InjectionDefense*InjectionDefenseConfigPrompt injection defense
Transformations[]TransformationRuleRegex-based request/response transformations
Network*NetworkPolicyNetwork allowlist/denylist
Audit*AuditConfigAudit logging
EnvSecurity*EnvSecurityConfigEnvironment variable masking
Toxicity*ToxicityConfigToxicity scanner
CodeSecurity*CodeSecurityConfigCode security scanner
InvisibleText*InvisibleTextConfigInvisible Unicode scanner

​
Methods

MethodReturnsDescription
policy.RequiresTLSInterception()booltrue if any scanner requires TLS interception
policy.ToJSON()map[string]interface{}Serialize to API-compatible map
ParseSecurityPolicy(data)*SecurityPolicyDeserialize from API response

​
PIIConfig

Configure detection and handling of personally identifiable information in outbound HTTP traffic. 
pii := &declaw.PIIConfig{
    Enabled: true,
    Types:   []declaw.PIIType{declaw.PIIEmail, declaw.PIICreditCard, declaw.PIISSN},
    Action:  declaw.RedactionActionRedact,
    Model:   "presidio",
}
FieldTypeDefaultDescription
EnabledboolfalseWhether PII scanning is active
Types[]PIITypeall typesPII types to scan for
ActionRedactionAction""Action on detection: "redact", "block", "log_only"
Modelstring""Scanner model to use

​
PIIType constants

const (
    PIIEmail      PIIType = "email"
    PIIPhone      PIIType = "phone"
    PIISSN        PIIType = "ssn"
    PIICreditCard PIIType = "credit_card"
    PIIPersonName PIIType = "person_name"
    PIIAPIKey     PIIType = "api_key"
    PIIAddress    PIIType = "address"
    PIIIPAddress  PIIType = "ip_address"
)

​
RedactionAction constants

const (
    RedactionActionRedact  RedactionAction = "redact"
    RedactionActionBlock   RedactionAction = "block"
    RedactionActionLogOnly RedactionAction = "log_only"
)

​
InjectionDefenseConfig

Detect and block prompt injection attempts in outbound HTTP request bodies. 
injection := &declaw.InjectionDefenseConfig{
    Enabled:     true,
    Sensitivity: declaw.InjectionSensitivityMedium,
    Action:      declaw.InjectionActionBlock,
}
FieldTypeDefaultDescription
EnabledboolfalseWhether injection defense is active
SensitivityInjectionSensitivity"""low", "medium", or "high"
ActionInjectionAction"""block" or "log_only"

​
ToxicityConfig

Scan outbound HTTP request bodies for toxic content. 
toxicity := &declaw.ToxicityConfig{
    Enabled:   true,
    Threshold: 0.9,
}
FieldTypeDefaultDescription
EnabledboolfalseWhether toxicity scanning is active
Thresholdfloat640Confidence threshold (0.0–1.0)

​
CodeSecurityConfig

Detect suspicious code in outbound HTTP request bodies. 
codeSec := &declaw.CodeSecurityConfig{
    Enabled:                 true,
    DetectSuspiciousImports: true,
}
FieldTypeDefaultDescription
EnabledboolfalseWhether code-security scanning is active
DetectSuspiciousImportsboolfalseFlag suspicious import statements

​
InvisibleTextConfig

Detect invisible or control Unicode characters in outbound HTTP request bodies. 
invisible := &declaw.InvisibleTextConfig{
    Enabled:         true,
    DetectZeroWidth: true,
}
FieldTypeDefaultDescription
EnabledboolfalseWhether invisible-text scanning is active
DetectZeroWidthboolfalseDetect zero-width characters

​
NetworkPolicy

Network allowlist and denylist for outbound traffic from the sandbox. 
network := &declaw.NetworkPolicy{
    AllowOut: []string{"pypi.org", "*.github.com"},
    DenyOut:  []string{"0.0.0.0/0"}, // or use declaw.AllTraffic for wildcard "*"
}
FieldTypeDescription
AllowOut[]stringDestinations to allow (IPs, CIDRs, domains)
DenyOut[]stringDestinations to deny (IPs, CIDRs)

​
TransformationRule

Regex-based text transformation applied to outbound request bodies, inbound response bodies, or both. 
rule := declaw.TransformationRule{
    Match:     `Bearer [A-Za-z0-9\-_\.]+`,
    Replace:   "Bearer [REDACTED]",
    Direction: declaw.TransformOut,
}
FieldTypeDescription
MatchstringRegular expression pattern
ReplacestringReplacement string
DirectionTransformDirection"in", "out", or "both"

​
AuditConfig

Toggle audit logging for sandbox activity. 
audit := &declaw.AuditConfig{
    Enabled:             true,
    RedactSensitiveData: true,
}

​
EnvSecurityConfig

Control how environment variable values are masked in audit logs. 
envSec := &declaw.EnvSecurityConfig{
    MaskPatterns: []string{"*_KEY", "*_SECRET", "*_TOKEN"},
    SensitiveVars: []declaw.SecureEnvVar{
        {Name: "OPENAI_API_KEY", Value: "sk-..."},
    },
}

​
Full policy example

policy := declaw.SecurityPolicy{
    PII: &declaw.PIIConfig{
        Enabled: true,
        Types:   []declaw.PIIType{declaw.PIIEmail, declaw.PIISSN, declaw.PIICreditCard},
        Action:  declaw.RedactionActionRedact,
    },
    InjectionDefense: &declaw.InjectionDefenseConfig{
        Enabled:     true,
        Sensitivity: declaw.InjectionSensitivityHigh,
        Action:      declaw.InjectionActionBlock,
    },
    Network: &declaw.NetworkPolicy{
        AllowOut: []string{"api.openai.com", "pypi.org"},
        DenyOut:  []string{"0.0.0.0/0"}, // CIDR deny-all
    },
    Transformations: []declaw.TransformationRule{
        {
            Match:     `sk-[A-Za-z0-9]+`,
            Replace:   "sk-[REDACTED]",
            Direction: declaw.TransformOut,
        },
    },
    Audit: &declaw.AuditConfig{Enabled: true},
}

sbx, err := declaw.Create(ctx, declaw.WithSecurity(policy))