15:I[981,["658","static/chunks/658-a698693f56d0116a.js","183","static/chunks/183-6beeeb801c274aaa.js","474","static/chunks/app/%5Btype%5D/layout-631c4730b83c8223.js"],"Posts"] 16:T7fa,CloakPipe is a small Rust proxy that sits between your application and any OpenAI-compatible API.

It detects sensitive entities in requests, replaces them with consistent pseudonyms, forwards the sanitized request to the LLM provider, then rehydrates the response before returning it to your app.

“Consistent” means the same input always maps to the same token (e.g. "Tata Motors" → "ORG_7"). This preserves semantic structure so embeddings and retrieval still work, while ensuring the API provider never sees the real entity values.

The motivation came from looking at typical RAG architectures. A standard pipeline leaks data in multiple places per query:

- Raw document text sent to embedding APIs - Embeddings stored in cloud vector databases (recent work like Zero2Text shows they can be inverted) - Query embeddings sent to providers - Retrieved context sent to LLM generation APIs

Existing approaches tend to fall into three buckets:

- Redaction ([REDACTED]) which destroys semantic meaning and breaks retrieval - NER-based detection pipelines that add significant latency - Stateless replacements that break vector search because tokens change between requests

CloakPipe tries to solve this by doing deterministic pseudonymization with a local mapping vault.

Some implementation details:

- Written in Rust as a single binary - <5ms overhead per request in testing - AES-256-GCM encrypted mapping vault with zeroize memory safety - OpenAI-compatible proxy endpoints (`/v1/chat/completions`, `/v1/embeddings`) - Streaming response rehydration (handles tokens split across SSE chunks) - Pattern detection for API keys, JWTs, emails, IPs, financial amounts, fiscal dates - Custom detection rules via TOML config

It's designed to be drop-in: point your client to the proxy by

Self taught gen-xers with senior dev/pm exp. Where's my imposter syndrome team?

Lotus 1-2-3 on the PC with DOS

Knightian Uncertainty

Generate cell-type specific mRNAs for better vaccines autoregressively

Withheld Epstein files with accusations against Trump released by justice dept

Three Quiet Brothers on Long Island, All of Them Related to Hitler

Time to teach our children about finance

A Plea for Lean Software (1995) [pdf]

Show HN: CloakPipe – Rust privacy proxy for LLM APIs with pseudonymization

An approach to provably safe AI engineering for legacy codebases

M6 MacBook Pro could have four innovations new to the Mac

We fixed Postgres connection pooling on serverless with PgDog

Interpreting Pull Request Changes Before CI Enforcement

Colorado SB26-051 Age Attestation

When Using AI Leads to "Brain Fry"

Artificial Intelligence: friend or foe for hiring in Europe today?

Making Hybrid Bonding Better

Building a High-Performance Postgres Time Series Stack with Iceberg

Advice for Staying in the Hospital for a Week

Scientist rule out a 2032 lunar impact for asteroid 2024 YR4

Claude Code Skill to write better Lean4 proofs

US companies denied refunds on Trump's illegal tariffs

Why Can't I Think of Anything to Vibe Code?

Show HN: What Is AI Citation Optimization?

OpenAI sued for practicing law without a license

Context Engineering

Show HN: Mog, a programming language for AI agents

From vibes to data: measuring how LLMs attend to your prompt, layer by layer

New imagery suggests U.S. responsible for Iran school strike

'Toughest kid on the block': Ada lawsuit dismissed against Satchel's Pizza

Show HN: Veil – On-device meeting transcription with 100% PII redaction