> ## Documentation Index
> Fetch the complete documentation index at: https://docs.hexr.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# OWASP Top 10 for GenAI

> How Hexr addresses every risk in the OWASP Top 10 for Large Language Model Applications.

## Compliance Matrix

| #         | OWASP Risk                       | Hexr Protection                                                   | Status |
| --------- | -------------------------------- | ----------------------------------------------------------------- | ------ |
| **LLM01** | Prompt Injection                 | LLM Guard prompt injection scanner, multi-strategy detection      | ✅      |
| **LLM02** | Insecure Output Handling         | LLM Guard response scanner, PII/secret detection                  | ✅      |
| **LLM03** | Training Data Poisoning          | External to runtime — out of scope for Hexr                       | ⚠️     |
| **LLM04** | Model Denial of Service          | Token limit checks, OPA rate limiting, resource quotas            | ✅      |
| **LLM05** | Supply Chain Vulnerabilities     | `hexr audit` SBOM + vulnerability scanning, signed images         | ✅      |
| **LLM06** | Sensitive Information Disclosure | PII scanner, secrets scanner, vault isolation, no env vars        | ✅      |
| **LLM07** | Insecure Plugin Design           | Gateway credential scoping, OPA per-service policies, SPIFFE auth | ✅      |
| **LLM08** | Excessive Agency                 | OPA policies restrict actions, per-process identity limits scope  | ✅      |
| **LLM09** | Overreliance                     | Topic boundary scanner detects off-topic responses                | ✅      |
| **LLM10** | Model Theft                      | Models accessed via API, no local model storage, audit logging    | ✅      |

***

## LLM01: Prompt Injection — Deep Dive

Hexr deploys multiple defenses:

1. **Input scanning** — LLM Guard scans every prompt before sending to the LLM
2. **Output scanning** — Responses are scanned for hallucinated tool calls
3. **Credential scoping** — Even if injection succeeds, the agent can only access authorized resources
4. **Per-process identity** — A researcher sub-agent can't escalate to admin-level access

***

## LLM06: Sensitive Information — Deep Dive

Multiple layers prevent sensitive data leakage:

1. **PII detection** — Scans input and output for email, phone, SSN, credit card patterns
2. **Secrets detection** — Catches API keys, tokens, and passwords
3. **Vault isolation** — Secrets stored per-agent, never in environment variables
4. **SPIFFE scoping** — Sub-processes can only access their own secrets
5. **Audit trail** — Every vault access and LLM call is traced

***

## LLM07: Insecure Plugin Design — Deep Dive

Traditional agents have a "confused deputy" problem — plugins run with the agent's full permissions. Hexr fixes this:

```
Traditional:
  Agent → Plugin → Cloud (agent's full credentials)

Hexr:
  Agent Process (researcher) → OPA Check → Credential Injector → Cloud
                                  ↓
                         Only BigQuery allowed
                         (not S3, not DynamoDB)
```

Each sub-process gets exactly the permissions it needs, nothing more.