Maskit

What it is

Maskit (AGPL-3.0, ghcr.io/xiayutian11/maskit) is the local redaction gateway the summary describes. This document covers the operational details that decide whether it actually protects you — because several of the protections the summary lists are off by default or only partially implemented, and the failure mode is fail-open.

Defaults that undercut the summary

The summary says Maskit redacts API keys, connection strings, private IPs, PEM keys, JWTs, and PII. The page is more specific: there are 21 rule categories, but only 7 are enabled out of the box — API Key, bank card, DB connection string, email, national ID, landline, mobile number. The other 14 are off by default, and they include exactly the credential/infra classes the summary highlights: PEM private keys, JWT, Token, Secret, cloud AccessKeys, internal/public IP, IPv6, MAC. The stated rationale is that these "cold" rules cause false positives that confuse the model on normal code/config. If you rely on Maskit to catch PEM keys or IPs, you must enable those rules manually.

The local ONNX NER model (names/orgs/addresses) is likewise disabled by default; regex is assumed to cover the main cases.

Fail-open by design

The proxy and extension both pass plaintext through when the engine is down or the token is invalid — an explicit "never break your network" tradeoff. The extension shows this as status colors: green = redacting, yellow = engine not started, plaintext passthrough, red = bad token/switch off, also passthrough. To make it fail-closed instead ("fail the request rather than leak plaintext"), enable "block when engine unavailable" in settings.

Coverage gaps to know

• XHR streaming-response restoration currently covers only DeepSeek web. Other sites keep native behavior.
• File/attachment redaction is adapted only for ChatGPT and Claude. DeepSeek and other sites transmit uploaded files unredacted (with a popup warning). Do not upload sensitive documents to those sites.
• The three built-in extension sites (chatgpt.com, claude.ai, deepseek.com) are pre-tested; 14 other presets (Kimi, Qwen, Gemini, Grok, Copilot, etc.) are one-click-authorizable but untested sites are flagged as such.

What to do

Proxy mode — point tools at the local port; no CA cert install needed:

export OPENAI_BASE_URL="http://127.0.0.1:18701/v1"
export ANTHROPIC_BASE_URL="http://127.0.0.1:18703"

Default port map: OpenAI 18701, DeepSeek 18702, Anthropic 18703.

Docker (panel token must be ≥16 ASCII chars, no Chinese, or the engine falls back to a random logged token):

docker run -d --name maskit --restart unless-stopped \
  -p 127.0.0.1:5801:5801 -p 127.0.0.1:18701:18701 \
  -v maskit_data:/data \
  -e MASKIT_PANEL_TOKEN="YourSecretToken123456" \
  ghcr.io/xiayutian11/maskit:latest

Port 5801 is the web console (required); 18701+ are reverse-proxy ports opened as needed. If fronting with Nginx/TLS, add -e MASKIT_TRUST_PROXY=1 so X-Forwarded-Proto: https passes Origin validation. Bindings default to 127.0.0.1; drop the prefix only for deliberate LAN exposure.

Caveats

The multi-turn placeholder consistency, offset-map cleartext-leak prevention, and prompt-injection detection are as the summary states. The load-bearing caveat is the combination above: default-on rules cover only 7 of 21 classes, NER is off, DeepSeek file uploads and non-DeepSeek XHR streams are unprotected, and the whole system fails open unless you flip it to fail-closed.