The Content Firewall
Everything we publish on your behalf is loaded into other people's AI assistants with your name on it. That makes your agent surface a supply-chain surface. The Content Firewall gates every publish — and every scheduled re-crawl — so nothing malicious ever goes live under your brand.
What it scans for
- Prompt-injection phrases — "ignore previous instructions", planted system prompts, "do not tell the user", credential/exfil requests.
- Invisible & bidirectional characters — zero-width spaces, bidi overrides, and other Unicode used to hide steering text a human reviewer can't see.
- Hidden-text remnants —
display:none/visibility:hidden/opacity:0content and stray HTML comments carrying instructions. - Exfiltration-shaped URLs — data: URIs, links that interpolate conversation/context into their query, and oversized query payloads.
How it behaves
- Block by default: a publish that contains any of the above is rejected with fingerprinted findings — the previous surface stays live, so a poisoned crawl never distributes.
- Invisible content always blocks — generated artifacts have no legitimate use for zero-width/bidi characters or hidden text, even in warn mode.
- Warn mode + allowlist for the heuristic rules, so a reviewed false positive can be exempted by fingerprint without weakening the gate for anything else.
The promise is simple: we won't distribute injection under your brand. The same detectors power the audit's injection hygiene security check, so you can see where any site stands before onboarding.