Architecture
Security
How the browser demo, hosted live audits, and report access work, including the limits of the current authorization check.
Authorization check
The public Live Audit form requires you to check 'I confirm that I am authorized to test this target' before Start Audit is enabled. The backend does not independently enforce that acknowledgment. Test only systems you own or are authorized to assess.
Browser demo
The public demo is simulated in your browser. It does not send attack traffic to real targets or require API keys.
Hosted live audits
Live audit requests pass through PromptSlayer's hosted backend to the target, model provider, or evaluator you configure.
Browser storage
The frontend keeps local preferences and audit references in localStorage. It excludes API keys, evaluator API keys, custom headers, webhook custom headers, and system prompts.
Results and report access
The backend may store live audit results temporarily. On startup, it deletes audits older than 30 days; ephemeral infrastructure may remove them sooner. Report access requires a long random view token that the backend validates.
Credentials
You provide target and evaluator API keys for live audits. The backend receives them and may use them with your chosen target, provider, or evaluator. It removes API key, evaluation API key, and custom header fields before saving audit configuration, and does not intentionally log credential-bearing audit request bodies.
Request and export controls
The backend includes checks to reduce requests to internal network addresses through user-configured endpoints. Spreadsheet (CSV) exports escape cells that could be treated as formulas, and browser cross-origin access to backend responses is restricted to configured origins.
Project status
PromptSlayer is currently a private AI security research and portfolio project for authorized defensive evaluation.