Chimera Gateway is a multi-provider AI routing system that handles:

• External API keys (Groq, Google, OpenRouter, etc.)
• User prompts and responses
• Optional encrypted outputs (AES-256-GCM)
• Tool routing and provider fallback logic

Because it operates as a network-facing AI gateway, security is a first-class design goal.

We assume adversarial input from:

• Prompt injection attacks
• Malicious tool-call manipulation
• SSRF attempts via model outputs
• API key leakage attempts
• Encoded payload bypass (Base64, Unicode, nested JSON)
• Provider-side malicious responses

Location: security/waf.py

Blocks:

• SQL injection
• XSS payloads
• Command injection
• Path traversal (../)
• Encoded bypass attempts

Location: security/prompt_shield.py

Detects:

• Multi-shot prompt injection
• Role confusion attacks (system prompt leakage)
• Instruction override attempts

Location: security/content_policy.py

Blocks:

• CSAM content
• Weapons of mass destruction instructions
• Self-harm content
• Illegal instruction generation (configurable)

Location: security/ssrf.py

Prevents:

• Internal network access (localhost, 169.254.x.x)
• Metadata service attacks (/latest/meta-data)

Location: security/canary.py

Detects:

• API key leakage in model outputs
• Secret exfiltration attempts
• Prompt-based data extraction

Location: security/nonce.py

Prevents:

• Request replay attacks
• Duplicate payload execution

Location: security/output_guard.py

Validates:

• Tool call structure
• Response schema integrity
• Malicious JSON injection

• Keys are never logged in full
• Keys are stored only in environment variables
• Optional masking is applied in debug logs
• Rotation is recommended every 30–90 days

Chimera supports optional response encryption:

• Algorithm: AES-256-GCM
• Key exchange: X25519
• Scope: per-request encryption

Enabled via:

{
  "encrypt": true
}

• Do NOT open a public issue with exploit details
• Contact maintainer privately

• Payload (if any)
• Provider affected

Run full security suite:

pytest tests/ -m security -v

Fuzz testing:

python security/ultimate_fuzzer.py

• Regex-based WAF may produce rare false positives

• Provider-side responses are not fully controllable

• Some encoded injection variants may bypass initial filters (mitigated downstream)