How do I use Helicone to block prompt injection attempts?

I've been evaluating Helicone as a proxy layer for our LLM calls, primarily for cost analytics. A secondary use case we explored was prompt security, specifically injection blocking. The documentation is a bit scattered on this, so here are the concrete steps and configurations that worked.

Helicone provides guardrails via its "Custom Properties" feature. You can set up server-side validators that check prompts before they're forwarded to your provider (OpenAI, Anthropic, etc.). The key is to use the `helicone-property-validator` header in your request to Helicone's proxy endpoint.

Here's a basic example using the OpenAI SDK, where we attach a validator to block prompts containing specific patterns:

```javascript
// Example using the OpenAI Node.js client configured to use Helicone
import OpenAI from "openai";

const openai = new OpenAI({
baseURL: "https://oai.hconeai.com/v1",
defaultHeaders: {
"Helicone-Auth": `Bearer ${process.env.HELICONE_API_KEY}`,
"helicone-property-validator": JSON.stringify({
"block_if_contains": ["ignore previous", "system prompt", "###"]
})
}
});
```

For more complex logic (regex, allow lists), you must deploy a custom validator as a Cloudflare Worker and reference it in your Helicone settings. The validator structure is straightforward:

```javascript
// Simplified validator worker example
export default {
async fetch(request, env) {
const requestBody = await request.json();
const userPrompt = requestBody.messages?.[0]?.content || "";

const blockPatterns = [/ignore previous/i, /system prompt/i];
if (blockPatterns.some(pattern => pattern.test(userPrompt))) {
return new Response('Blocked: Prompt injection attempt detected', { status: 400 });
}
return new Response(JSON.stringify({ "action": "allow" }), { status: 200 });
}
}
```

Important findings from our tests:
* The validation runs **before** the request is logged or cost is incurred, which is correct for security.
* Latency added is minimal (<50ms in our benchmarks).
* You can chain multiple validators (e.g., for PII, toxicity, injection).
* The main limitation is that the custom validator must be hosted externally; Helicone doesn't host the logic itself.

For our stack (dbt, Airflow), we integrated this by setting the validator headers in our Python service layer, ensuring all LLM calls pass through the same security check.