diff --git a/docs/guides/security-notes.mdx b/docs/guides/security-notes.mdx index 71ee6cc..bd1bba9 100644 --- a/docs/guides/security-notes.mdx +++ b/docs/guides/security-notes.mdx @@ -98,7 +98,7 @@ It does not scan: It cannot change what the SDK stores. The conversation store keeps the original prompt, and the SDK builds the conversation title from it. -This matters most for indirect prompt injection. If a tool fetches a web page, reads a document, or queries a record that contains injected instructions, the SDK hands that content to the model without passing it through Intercept. +This matters most for indirect prompt injection. A tool might fetch a web page, read a document, or query a record that contains injected instructions. The SDK hands that content to the model without passing it through Intercept. Tool Approval Guard narrows that gap but does not close it. It inspects what the model *proposed* after reading poisoned content, which is where the damage usually surfaces. It cannot inspect the poisoned content itself. It also only applies to tools that are approval-gated. A tool that runs without approval is never inspected. diff --git a/docs/middleware/budget-guard.mdx b/docs/middleware/budget-guard.mdx index 9cd79fb..5a096f9 100644 --- a/docs/middleware/budget-guard.mdx +++ b/docs/middleware/budget-guard.mdx @@ -109,7 +109,7 @@ new BudgetGuard( ## How cost is estimated and tracked -Before the step reaches the provider, the middleware estimates the step's input tokens. It divides the character count of the full message history it is about to send, including tool call arguments and tool results, by an average characters-per-token ratio. Output tokens are assumed (`assumedOutputTokens`, default 1000), since the real count is not known until the provider replies. +Before the step reaches the provider, the middleware estimates the step's input tokens. It divides the character count of the full message history it is about to send, including tool call arguments and tool results, by an average characters-per-token ratio. The middleware assumes a fixed output token count (`assumedOutputTokens`, default 1000), since the real count is not known until the provider replies. ```php new BudgetGuard( @@ -180,7 +180,7 @@ new BudgetGuard(action: 'log') // observe before enforcing Request would exceed its configured budget [request: $0.6300 of $0.5000]. ``` -The exception names the breached budget and the dollar amounts, but never the session or user key spend was tracked against. +The exception names the breached budget and the dollar amounts, but never the session or user key the middleware tracked spend against. ```php use PromptPHP\Intercept\BudgetGuard\Exceptions\BudgetGuardException; diff --git a/docs/middleware/injection-guard.mdx b/docs/middleware/injection-guard.mdx index dcdcb31..2bf8ad9 100644 --- a/docs/middleware/injection-guard.mdx +++ b/docs/middleware/injection-guard.mdx @@ -9,7 +9,7 @@ sidebarTitle: "Injection Guard" It can block, log, warn, sanitize, or delegate handling to a custom callback. - This middleware is a lightweight heuristic guard. It targets common prompt injection patterns. Don't treat it as complete protection against every possible attack. + This middleware is a lightweight heuristic guard. It targets common prompt injection patterns. Do not treat it as complete protection against every possible attack. ## Installation