OWASP Top 10 for GenAI

Compliance Matrix

#	OWASP Risk	Hexr Protection	Status
LLM01	Prompt Injection	LLM Guard prompt injection scanner, multi-strategy detection	✅
LLM02	Insecure Output Handling	LLM Guard response scanner, PII/secret detection	✅
LLM03	Training Data Poisoning	External to runtime — out of scope for Hexr	⚠️
LLM04	Model Denial of Service	Token limit checks, OPA rate limiting, resource quotas	✅
LLM05	Supply Chain Vulnerabilities	`hexr audit` SBOM + vulnerability scanning, signed images	✅
LLM06	Sensitive Information Disclosure	PII scanner, secrets scanner, vault isolation, no env vars	✅
LLM07	Insecure Plugin Design	Gateway credential scoping, OPA per-service policies, SPIFFE auth	✅
LLM08	Excessive Agency	OPA policies restrict actions, per-process identity limits scope	✅
LLM09	Overreliance	Topic boundary scanner detects off-topic responses	✅
LLM10	Model Theft	Models accessed via API, no local model storage, audit logging	✅

LLM01: Prompt Injection — Deep Dive

Hexr deploys multiple defenses:

Input scanning — LLM Guard scans every prompt before sending to the LLM
Output scanning — Responses are scanned for hallucinated tool calls
Credential scoping — Even if injection succeeds, the agent can only access authorized resources
Per-process identity — A researcher sub-agent can’t escalate to admin-level access

LLM06: Sensitive Information — Deep Dive

Multiple layers prevent sensitive data leakage:

PII detection — Scans input and output for email, phone, SSN, credit card patterns
Secrets detection — Catches API keys, tokens, and passwords
Vault isolation — Secrets stored per-agent, never in environment variables
SPIFFE scoping — Sub-processes can only access their own secrets
Audit trail — Every vault access and LLM call is traced

LLM07: Insecure Plugin Design — Deep Dive

Traditional agents have a “confused deputy” problem — plugins run with the agent’s full permissions. Hexr fixes this:

Traditional:
  Agent → Plugin → Cloud (agent's full credentials)

Hexr:
  Agent Process (researcher) → OPA Check → Credential Injector → Cloud
                                  ↓
                         Only BigQuery allowed
                         (not S3, not DynamoDB)

Each sub-process gets exactly the permissions it needs, nothing more.

Getting Started

Self-Hosted Deployment

Architecture

Security & Compliance

OWASP Top 10 for GenAI

Compliance Matrix

LLM01: Prompt Injection — Deep Dive

LLM06: Sensitive Information — Deep Dive

LLM07: Insecure Plugin Design — Deep Dive

​Compliance Matrix

​LLM01: Prompt Injection — Deep Dive

​LLM06: Sensitive Information — Deep Dive

​LLM07: Insecure Plugin Design — Deep Dive

Compliance Matrix

LLM01: Prompt Injection — Deep Dive

LLM06: Sensitive Information — Deep Dive

LLM07: Insecure Plugin Design — Deep Dive