Found in the cross-endpoint parity audit following AISIX-Cloud#947 (see ai-gateway#695).
These three handlers run check_input so a block-action detector works, but they never call any redact_* function — a kind: pii detector configured with mask silently forwards the raw text upstream (the mask action becomes a no-op, with no error and no counts). Contrast: embeddings masks input via redact_input_text (embeddings.rs:323,332), and chat/messages/responses/completions all mask both sides.
- rerank.rs:
check_input at ~226, zero redact_* calls in the file (query + documents forwarded raw)
- images.rs:
check_input present, zero redact_* calls (prompt forwarded raw)
- audio.rs:
check_input at ~586 scans TTS input text only, zero redact_* calls
Additionally the transcription/translation response text (real model output) is neither output-guardrailed nor mask-redacted — an output-hook block/mask rule enforced on chat is bypassable by transcribing audio.
Fix shape: add redact_rerank_request / redact_images_request / redact_audio_request (+ transcription response output scan/redact) mirroring the #932 helpers, and merge counts into the emitted UsageEvent like the sibling handlers.
Found in the cross-endpoint parity audit following AISIX-Cloud#947 (see ai-gateway#695).
These three handlers run
check_inputso a block-action detector works, but they never call anyredact_*function — akind: piidetector configured with mask silently forwards the raw text upstream (the mask action becomes a no-op, with no error and no counts). Contrast: embeddings masks input viaredact_input_text(embeddings.rs:323,332), and chat/messages/responses/completions all mask both sides.check_inputat ~226, zeroredact_*calls in the file (query + documents forwarded raw)check_inputpresent, zeroredact_*calls (prompt forwarded raw)check_inputat ~586 scans TTSinputtext only, zeroredact_*callsAdditionally the transcription/translation response text (real model output) is neither output-guardrailed nor mask-redacted — an output-hook block/mask rule enforced on chat is bypassable by transcribing audio.
Fix shape: add
redact_rerank_request/redact_images_request/redact_audio_request(+ transcription response output scan/redact) mirroring the #932 helpers, and merge counts into the emitted UsageEvent like the sibling handlers.