Wiring a Security-Focused Model Into a Solo Developer's Audit — The Extraction Layer and Fingerprints That Stop Re-Reporting
A three-layer design that extracts outbound-request sinks with the AST, then accepts a model's hypothesis only when the reproduction actually runs. Four fingerprint schemes measured, including the collision that hides a real finding behind a safe twin.
Production-Grade PII Redaction for the Gemini API — Detection, Masking, and Audit Logging That Actually Pass a Privacy Review
Are you piping raw user text straight into the Gemini API? This guide walks through detection, masking, and audit-log design so you can keep PII out of model traffic and pass GDPR, SOC 2, and customer privacy reviews — with code you can ship today.
Defending Gemini API Apps from Prompt Injection: A Multi-Layer Production Architecture
A four-layer prompt injection defense for Gemini apps: sanitized input, hardened prompts, structured output, and a moderator LLM — with runnable Python.
A Webhook Is a Claim, Not a Fact — Three Layers of Defense for Your Gemini Webhooks Endpoint
Your Gemini Webhooks receiver is a public URL, which means forged events, replays, and duplicate deliveries are all on the table. This walkthrough builds a three-layer defense — reachability checks, dedupe, and a lightweight handler that re-fetches truth from the API — with working FastAPI and SQLite code.
Locking Down a Gemini API Key on Servers Whose IP Keeps Changing — Restrictions for Headless Automation
After unrestricted keys started getting blocked, headless server automation whose egress IP changes every run can't cleanly use HTTP referrer, app restrictions, or an IP allowlist. Do you get by with API restrictions alone, funnel egress through a fixed IP, or move server workloads off API keys onto Vertex service-account auth? A decision framework and working code, without taking your pipelines down.
Getting Artifacts Out of a Managed Agents Sandbox Safely — Scoped Credentials and Egress Design
Gemini API Managed Agents run in a Google-hosted isolated sandbox. Here is the short-lived, least-privilege credential and egress-boundary design I use to return generated artifacts to my own repository safely.
Keeping Apps Script + Gemini Automations on Least Privilege: Explicit Scopes and Catching Scope Creep
Apps Script automations that call Gemini quietly accumulate OAuth scopes. Here is how to declare explicit scopes in appsscript.json, catch scope creep in CI, and avoid forcing every user to re-consent.
Audit Your Gemini API Key Restrictions Before the Unrestricted-Key Block Stops Your Automation
Since June 19, 2026, requests from unrestricted Gemini API keys are blocked. Here is how to check whether your key is affected and add restrictions without taking your production automation down.
Harden the Layer Before Gemini Sees User Media — A Validation Pipeline You Can Actually Run
Piping user-uploaded images and video straight into Gemini walks you into MIME spoofing, EXIF leaks, decompression bombs, and video that isn't ready yet. Here's the validation layer—magic-byte sniffing, Files API state polling, and cleanup—built up in working code.
Defending Against Prompt Injection When You Pass External Text to the Gemini API
User reviews, scraped articles, and other untrusted text are the entry point for indirect prompt injection when you feed them to the Gemini API. Here is a prioritized, code-backed defense you can drop into a production pipeline: trust-boundary isolation, schema constraints, a two-stage screening pass, and output sanitization.
Permission-Aware RAG — Designing Gemini Search That Only Cites What the User Is Allowed to See
The day you add RAG to internal search, drafts and finance memos nobody should see start leaking into answers. This is a production design — metadata filtering, defense in depth, and audit logging — for letting Gemini search while respecting permissions, with working code.
Why HTTP Referrer Restrictions on Your Gemini API Key Cause 403 Errors in Production
Walks through why a Gemini API key with HTTP referrer restrictions can suddenly return 403 PERMISSION_DENIED in production. Covers the exact referrer string format, SDK behavior differences, how to safely route around the limitation with a tiny edge proxy, and how it differs from the CORS error you hit when calling straight from the browser.