ScanResult
The result of a threat scan.Properties
| Property | Type | Description |
|---|---|---|
is_safe | bool | True if no threats detected |
is_threat | bool | True if any threat detected |
detections | list[Detection] | List of all detections |
highest_severity | Severity | Highest severity found |
detection_count | int | Number of detections |
scan_duration_ms | float | Scan duration in milliseconds |
l1_duration_ms | float | L1 (rule) scan duration |
l2_duration_ms | float | None | L2 (ML) scan duration if used |
prompt_hash | str | SHA-256 hash of prompt |
Example
Methods
to_dict()
Convert to dictionary for serialization.to_json()
Convert to JSON string.Detection
A single threat detection.Properties
| Property | Type | Description |
|---|---|---|
rule_id | str | Rule identifier (e.g., “pi-001”) |
rule_name | str | Human-readable rule name |
family | str | Threat family (PI, JB, PII, etc.) |
severity | Severity | Severity level |
confidence | float | Confidence score (0.0-1.0) |
matched_text | str | Text that matched the rule |
match_start | int | Start position in prompt |
match_end | int | End position in prompt |
description | str | Rule description |
layer | str | Detection layer (“L1” or “L2”) |
Example
Severity
Enumeration of threat severity levels.Values
| Value | Level | Description |
|---|---|---|
Severity.CRITICAL | 4 | Immediate threat, block |
Severity.HIGH | 3 | Serious threat, block or flag |
Severity.MEDIUM | 2 | Moderate threat, flag |
Severity.LOW | 1 | Minor concern, log |
Severity.NONE | 0 | No threat |
