Repository navigation
docs: use the Rampart backend for every sensitive info example - #983
Conversation
Remove the built-in pattern-matching detector from the sensitive info, data loss prevention, Guard, quick start and SDK reference docs. Every sensitive info example now passes the Rampart on-device backend, the entity tables list what Rampart detects, and custom detection uses Rampart recognizers. Delete the orphaned Next.js Edge runtime snippets, which can't run Rampart. Co-authored-by: david <david@arcjet.com>
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
Co-authored-by: david <david@arcjet.com>
arcjet-review
Bot
added
needs review
![arcjet-review[bot]](https://avatars.githubusercontent.com/u/24397786?s=60&v=4){kind=small}
There was a problem hiding this comment.
Arcjet Review — 🟢 Low Risk
Decision: Approved
Rationale: Pure documentation and example-snippet refactor that moves every sensitive-info example to the Rampart backend, matching the SDK change in arcjet/arcjet-js#6323. Changes are repetitive and consistent across ~177 files: add backend: rampart() to rule configs, add the matching @arcjet/sensitive-info-rampart / arcjet_sensitive_info_rampart / sensitiveinfo/rampart imports and install commands, rewrite the reference prose and entity table, and swap the token-based detect callback examples for Rampart recognizers. The Python reference also correctly tightens the sensitive_info_backend claim to apply only to remote policies. No auth, infra, dependency manifest or runtime code changes; no escalation triggers fired. Snapshot and screenshot updates match the prose changes.
Summary of Changes
Docs refactor: makes Rampart the default sensitive-info backend across every example (JS, Python, Go, all frameworks and Guard integrations), rewrites the Sensitive Info reference and overview around on-device Rampart, replaces token detect callbacks with Rampart recognizers (IBAN → BANK_ACCOUNT example), updates install commands and the Go and Python SDK reference pages, deletes the Next.js edge-runtime snippets (Rampart can't run on edge), and regenerates llms.txt and screenshot snapshots. Cloudflare Think Guard pages are intentionally left unchanged.
Notes
Diff is ~2300 lines across 177+ files, exceeding the 1000-line size threshold. The volume is justified by the mechanical, repetitive nature of the change (one-line additions to many parallel framework snippets) and the matching snapshot regeneration, which makes it reliably reviewable despite the size.
Review: b14561b4 | Model: anthropic/claude-opus-4-7 | Powered by Arcjet Review
| @@ -22,6 +22,7 @@ | |||
| ) | |||
| detect_pii = LocalDetectSensitiveInfo( | |||
| deny=["BANK_ACCOUNT", "ROUTING_NUMBER"], | |||
There was a problem hiding this comment.
Only backend=rampart(), is shown added here, with no accompanying from arcjet_sensitive_info_rampart import rampart in the diff. Can you confirm that import already exists above line 22 in this file? Every other py snippet in this PR adds the import explicitly, so if it's missing here the snippet won't run as copied.
| type that the active backend doesn't detect never matches. You can also detect | ||
| your own types with [custom entity detection](#custom-entity-detection). | ||
| Rampart detects the following entity types. List any of them in `allow` or | ||
| `deny`. Each one is an `ArcjetSensitiveInfoType` in JS, a |
There was a problem hiding this comment.
Nit: this paragraph says offsets are "UTF-16 code unit indexes in JS, code point indexes in Python, and byte offsets in Go – the indexes each language's regular expression matches return." Python's re.Match.start()/end() actually return indexes into the input string (code point indexes for str, byte offsets for bytes). Worth double-checking that Rampart's Python recognizer contract is specifically code point indexes and not just "whatever the input type gives you", so this doesn't mislead users who pass bytes.
| mode: "LIVE", // Will block requests, use "DRY_RUN" to log only | ||
| // allow: ["EMAIL"], Will block all sensitive information types other than email. | ||
| deny: ["EMAIL"], // Will block email addresses | ||
| deny: ["EMAIL"], // Will block email addresses, |
There was a problem hiding this comment.
Nit: the trailing comma inside the comment reads oddly — // Will block email addresses, — same pattern appears in Errors.ts, GlobalGuard.ts, PerRouteGuard.ts, WithinRoute.ts, and the SvelteKit Hooks.* snippets. Consider dropping the stray comma while you're touching these.
| deny: ["EMAIL"], // Will block email addresses, | |
| deny: ["EMAIL"], // Will block email addresses | |
| backend: rampart(), |
arcjet-review
Bot
removed
ai-review-in-progress
needs review
Removes the built-in pattern-matching (WebAssembly) sensitive info detector from the docs and makes Rampart the default everywhere. This follows the matching SDK README change in arcjet/arcjet-js#6323.
sensitiveInfo,localDetectSensitiveInfo/LocalDetectSensitiveInfo,detect_sensitive_info,arcjet.SensitiveInfoandGuardSensitiveInfoexample passes the Rampart backend. That covers the JS, Python and Go framework snippets, the Guard integrations, the DLP pages and the quick starts. Install commands add@arcjet/sensitive-info-rampart, thearcjet[sensitive-info-rampart]extra, or thesensitiveinfo/rampartGo module.detectcallback /ContextWindowSize/SensitiveInfoDetectexamples are replaced by Rampart recognizers (an IBAN recognizer that emitsBANK_ACCOUNT, appended to the default recognizers) in JS, Python and Go.sensitive_info_backendapplies toLocalDetectSensitiveInforules. It applies only to remote policies.Not changed: the Cloudflare Think Guard page and quick start. Rampart's model loader needs a filesystem, which Workers don't have, so those examples need a separate decision.