LLM Output Scanner
The model answered. Before that answer goes into a ticket, a report or a customer's inbox: did it reproduce someone's e-mail, IBAN or an API key from its context, and which of its confident citations has a human actually opened? Paste the output, get the sensitive values masked and every reference as a checklist.
Sensitive data reproduced in the output
| Line | Type | Source | Severity | Value | What it means |
|---|
Citations, URLs and figures to verify
Injection & unsafe-rendering signals
Two families, both about what the text would do if it is rendered or trusted, not about whether a claim is true. Structural signals (raw HTML/script, javascript:/data: URLs, auto-loading images) execute or exfiltrate if the output is dropped into a page as HTML/markdown (OWASP LLM05 — Improper Output Handling). Heuristic signals (instruction-override phrases, jailbreak markers, leaked system-prompt / chat tokens) look like prompt injection carried through to the output (OWASP LLM01 — Prompt Injection) — a document that discusses these attacks also matches, so they are a prompt to review, never a verdict.
| Line | Signal | Category | Severity | Basis | Evidence | Why it matters / how to handle |
|---|
Redacted copy
Why the output side is different. The LLM Pre-flight Redactor stops you sending sensitive data into a model. This tool looks at what came out: a model can reproduce a customer's e-mail or an access key it saw in the retrieved documents, the conversation, or its training data, and it can cite a paper, a URL, a CVE or a regulation article that does not exist or does not say what it claims (OWASP LLM Top 10: Sensitive Information Disclosure, Improper Output Handling, Misinformation — see the OWASP LLM Top 10 Checker). Personal data comes from the same detector library as the Pre-flight Redactor and the Log Snippet Anonymizer; credentials from the same rule set as the Secrets & Credential Leak Scanner. Regulatory articles link to the Compliance Reference Database so you can read the article the model quoted; CVEs link to NVD, DOIs to doi.org, RFCs to the RFC Editor. It also flags constructs that would execute or exfiltrate if the output is rendered as HTML/markdown (raw script, javascript:/data: URLs, auto-loading images) and heuristic prompt-injection / jailbreak markers echoed into the answer. Rule sets . Informational only: a citation or signal the tool lists is neither confirmed nor refuted, and text with nothing flagged can still be wrong — "no patterns matched" is not "safe".