diegosouzapw/OmniRoute · error

SECURITY_001

SECURITY_001

Error message

Request blocked: potential prompt injection detected

What it means

Error "Request blocked: potential prompt injection detected" thrown in diegosouzapw/OmniRoute.

Source

Thrown at src/app/api/v1/chat/completions/route.ts:178

        }

        // Resolve model alias before forwarding to handleChat
        if (parsedBody && typeof parsedBody === "object") {
          await resolveModelAliasWithSeedFallbackOnBody(parsedBody).catch(() => {
            /* swallow — fall through with original model */
          });
        }
        admission.lease = structuralAdmission.lease;

        const { blocked, result } = injectionGuard(parsedBody);
        if (blocked) {
          return finishAdmission(
            new Response(
              JSON.stringify({
                error: {
                  message: "Request blocked: potential prompt injection detected",
                  type: "injection_detected",
                  code: "SECURITY_001",
                  detections: result.detections.length,
                },
              }),
              { status: 400, headers: { ...CORS_HEADERS, "Content-Type": "application/json" } }
            )
          );
        }
      }
    } catch (error) {
      console.error("[SECURITY] Prompt injection guard failed:", error);
    }

    // Gate the early SSE keepalive wrapper: only wrap when the client explicitly
    // asks for streaming (body `stream: true`) or the Accept header forces SSE.
    // The parsed body is passed through UNTOUCHED — the actual stream/JSON framing
    // stays decided by chatCore/resolveStreamFlag (legacy streaming default and the
    // per-key `streamDefaultMode: "json"` opt-in are preserved).
    const parsedBodyIsRecord = isRecord(parsedBody);

View on GitHub (pinned to a179ffed5b)

When it happens

Trigger: Thrown at src/app/api/v1/chat/completions/route.ts:178 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of diegosouzapw/OmniRoute@a179ffed5b (2026-08-25). Data as JSON: /api/errors/a4f9b8d2ffefdc8b. Report an issue: GitHub.