Frequently Asked Questions (FAQ)

What is the performance overhead?

KoreShield adds approximately 5-20ms of latency per request, depending on the complexity of the detection rules enabled.

Can I run this in production?

Yes. We recommend running behind a standard reverse proxy (Nginx) and ensuring you have configured Rate Limiting and proper Authentication.

Does it support streaming responses?

Yes. The proxy supports full streaming (Server-Sent Events) for OpenAI-compatible endpoints.

How do I add a custom detection rule?

Currently, custom rules can be added via the config.yaml blocklist or by extending the AttackDetector class in Python. We are working on a DSL for custom rules in the Dashboard.

Is my data saved?

By default, KoreShield logs metadata and events to logs/koreshield.log. It does NOT store the full body of safe prompts unless configured to do so for debugging.