# AI use cases for Preflight (ghuntley/preflight)

Repo: [ghuntley/preflight](https://github.com/ghuntley/preflight) | Use cases: 5 | Page: https://dedupedai.com/use-cases/ghuntley-preflight/

preflight is a local proxy that sits between a coding harness and underclass, scanning LLM requests and attachments for secrets before they reach the model.

This file holds every use case of this repo. Each one starts with a "## " heading and ends with its URL.

- Redact pasted secrets before the model sees them: https://dedupedai.com/use-cases/ghuntley-preflight/redact-secrets-before-model-call/
- Block any request that contains a secret: https://dedupedai.com/use-cases/ghuntley-preflight/block-requests-containing-secrets/
- Scan screenshots and PDFs for keys before upload: https://dedupedai.com/use-cases/ghuntley-preflight/scan-screenshots-and-pdfs-for-keys/
- Tune detection rules in advisory mode first: https://dedupedai.com/use-cases/ghuntley-preflight/tune-detection-rules-in-advisory-mode/
- Trace one request across Preflight and underclass: https://dedupedai.com/use-cases/ghuntley-preflight/trace-one-request-across-both-proxies/

## How to redact pasted secrets before the model sees them with Preflight

Repo: [ghuntley/preflight](https://github.com/ghuntley/preflight) | Difficulty: Intermediate | Time: 30 minutes | Basis: From the README

Route agent traffic through Preflight so detected keys become placeholders and the request still runs.

**Who it is for:** A developer whose coding agent reads .env files and shell output, and who worries a pasted API key will reach the model.

**The problem:** Secrets can arrive inside source files, shell output, and documents, and a single leaked key can end up in a model provider's logs.

**The outcome:** Detected credentials are replaced with tokens such as [REDACTED:github-pat] and the agent keeps working on the sanitized request.

### Steps

1. Start Preflight alongside underclass with `nix run github:ghuntley/preflight -- serve`
2. Set the harness base URL to `http://127.0.0.1:8081/v1`
3. Keep the existing underclass API key; Preflight passes authorization through by default
4. Run a prompt that includes a fake key in a test file and confirm the request completes
5. Check the JSON logs for an `inspection.finding` event with a `rule_id` and no matched secret

### Prompt to paste into your agent

```text
Using the preflight repo at github.com/ghuntley/preflight, start the proxy in default redact mode, point the client at http://127.0.0.1:8081/v1, and send a test request containing a fake GitHub token from <test-file>. Report the HTTP status and the finding event from the JSON logs, and verify that the upstream request body contains [REDACTED:github-pat] rather than the token.
```

### Caveat

Redaction only covers credential shapes that Preflight's default rules recognize, so other sensitive data may pass through unchanged.

Disclaimer: Third-party repos we don't own or vouch for. AI-generated use cases can be wrong: review everything and run at your own risk. Full text: https://dedupedai.com/disclaimer/

URL: https://dedupedai.com/use-cases/ghuntley-preflight/redact-secrets-before-model-call/

## How to block any request that contains a secret with Preflight

Repo: [ghuntley/preflight](https://github.com/ghuntley/preflight) | Difficulty: Intermediate | Time: 30 minutes | Basis: From the README

Use no-go mode so requests with non-allowlisted findings get a 409 and never reach underclass.

**Who it is for:** A security-minded team lead who needs a hard stop rather than rewritten content when a secret appears in an agent prompt.

**The problem:** Redacted requests may still carry context the team does not want the model to process, so some incidents need a full stop.

**The outcome:** Requests with findings return HTTP 409 with opaque finding IDs, and nothing is forwarded to underclass.

### Steps

1. Create a TOML file with `mode = "no-go"` and the `bind`, `upstream`, and `carnet` values you need (inferred, check the README)
2. Validate the file with `preflight check --config /path/to/config.toml` (inferred, check the README)
3. Start the proxy with `preflight serve --config /path/to/config.toml`
4. Send a request containing a test secret and confirm the response status is 409
5. Reload settings after edits with `systemctl reload preflight` on NixOS

### Prompt to paste into your agent

```text
Using the preflight repo at github.com/ghuntley/preflight, write a config.toml with mode set to no-go, validate it with preflight check, and send a request containing a fake secret from <test-file> through the proxy. Expected output is an HTTP 409 with an opaque finding ID and no secret text, and verify that underclass received no request.
```

### Caveat

The README describes a NixOS reload command, so non-NixOS users must find their own way to send SIGHUP to the running process.

Disclaimer: Third-party repos we don't own or vouch for. AI-generated use cases can be wrong: review everything and run at your own risk. Full text: https://dedupedai.com/disclaimer/

URL: https://dedupedai.com/use-cases/ghuntley-preflight/block-requests-containing-secrets/

## How to scan screenshots and PDFs for keys before upload with Preflight

Repo: [ghuntley/preflight](https://github.com/ghuntley/preflight) | Difficulty: Intermediate | Time: 45 minutes | Basis: From the README

Let Preflight decode images and PDFs locally, run OCR, and sanitize them before inference.

**Who it is for:** A developer who attaches screenshots or PDF exports to an agent session and may not notice a key visible in the image.

**The problem:** Attachments are a common path for secrets, and a key in a screenshot is easy to miss.

**The outcome:** Attachments are decoded and OCR'd locally, and supported sanitization rewrites them before the model receives them.

### Steps

1. Start the proxy with `nix run github:ghuntley/preflight -- serve`
2. Point the harness at `http://127.0.0.1:8081/v1`
3. Attach a screenshot containing a test key from <test-file> and send a prompt about it
4. Check the logs for an `attachment.inspected` event with `rebuilt: true` when a rewrite happened
5. Confirm that a finding without a safe replacement returns an error rather than forwarding

### Prompt to paste into your agent

```text
Using the preflight repo at github.com/ghuntley/preflight, run the proxy with default settings, attach the image <test-file> containing a fake key to a request, and report the response status and the attachment.inspected log event. Verify that the forwarded attachment no longer shows the key or that the request was rejected.
```

### Caveat

Attachments that cannot be sanitized are blocked, and PDF page blacking out is off unless allow_page_redaction is set to true.

Disclaimer: Third-party repos we don't own or vouch for. AI-generated use cases can be wrong: review everything and run at your own risk. Full text: https://dedupedai.com/disclaimer/

URL: https://dedupedai.com/use-cases/ghuntley-preflight/scan-screenshots-and-pdfs-for-keys/

## How to tune detection rules in advisory mode first with Preflight

Repo: [ghuntley/preflight](https://github.com/ghuntley/preflight) | Difficulty: Advanced | Time: 45 minutes | Basis: From the README

Run advisory mode to log findings without changing traffic, then switch to enforcement.

**Who it is for:** A platform engineer who must confirm false positives are low before enforcing redaction across a team's agent traffic.

**The problem:** Enforcing rules too early can break legitimate prompts, but staying silent means secrets flow unchecked.

**The outcome:** The team sees which rules fire on real traffic and can add stopwords or a carnet before switching to redact or no-go.

### Steps

1. Set `mode = "advisory"` in a config file (inferred, check the README)
2. Validate it with `preflight check --config /path/to/config.toml` (inferred, check the README)
3. Start the proxy with `preflight serve --config /path/to/config.toml`
4. Review `inspection.finding` events and rule IDs in the JSON logs
5. Add exact exemptions to `stopwords` or hashes to `carnet`, then switch mode to `redact`

### Prompt to paste into your agent

```text
Using the preflight repo at github.com/ghuntley/preflight, set the mode to advisory in a config file, run preflight check, and send <N> sample prompts through the proxy. Report each rule_id that fired and whether it was a true or false positive, and verify that the forwarded content matches the original.
```

### Caveat

The README says advisory mode is useful for tuning but that detected secrets can reach the model in that mode, so keep it away from sensitive repositories.

Risk, credentials: Advisory mode forwards the original content, so detected secrets can reach the model while you tune rules.

Disclaimer: Third-party repos we don't own or vouch for. AI-generated use cases can be wrong: review everything and run at your own risk. Full text: https://dedupedai.com/disclaimer/

URL: https://dedupedai.com/use-cases/ghuntley-preflight/tune-detection-rules-in-advisory-mode/

## How to trace one request across Preflight and underclass with Preflight

Repo: [ghuntley/preflight](https://github.com/ghuntley/preflight) | Difficulty: Intermediate | Time: 30 minutes | Basis: From the README

Use the shared x-request-id to follow a single request through both proxy logs.

**Who it is for:** An engineer debugging a failed agent call who needs to see whether Preflight blocked it or underclass failed upstream.

**The problem:** Two proxies in sequence make it hard to tell which one handled a failing request.

**The outcome:** Searching one request_id in both services shows the full path from ingress to upstream response.

### Steps

1. Send a request through `http://127.0.0.1:8081/v1` and note the `x-request-id` in the response headers
2. Search the Preflight JSON logs for that value in the `request_id` field
3. Search the underclass logs for the same value
4. Compare `request.policy_completed` status with the underclass response status
5. Check `curl http://127.0.0.1:8081/metrics` for aggregate counters if you need totals (inferred, check the README)

### Prompt to paste into your agent

```text
Using the preflight repo at github.com/ghuntley/preflight, send one request to http://127.0.0.1:8081/v1/responses, capture the x-request-id header, and search both preflight and underclass logs for that ID. Report the status recorded by each service and verify that the IDs match.
```

### Caveat

The request ID is diagnostic metadata only and is not proof that inspection ran, so check the finding events for that.

Disclaimer: Third-party repos we don't own or vouch for. AI-generated use cases can be wrong: review everything and run at your own risk. Full text: https://dedupedai.com/disclaimer/

URL: https://dedupedai.com/use-cases/ghuntley-preflight/trace-one-request-across-both-proxies/