Libraries protect your code. But sooner or later, every team needs a central, deployable enforcement point for LLM security: one place where policies live, where access control is applied, and where every model call is logged. That is exactly what ReskSafety is — and you can try it right now at demo.resk.fr.
What Is ReskSafety?
ReskSafety is a full-stack, self-hostable LLM firewall built on FastAPI and React. It exposes an OpenAI-compatible endpoint (POST /v1/chat/completions): you point your existing applications at it, and every request passes through the firewall before reaching your model backend. No SDK rewrite, no code changes — just a base URL swap.
Core Capabilities
RBAC with 64-bit Capability Bitmasks
Every role carries a 64-bit capability bitmask. Capabilities cover tool usage, code generation, database access, email sending, PII handling, user management, and system configuration. Filtering policies are attached to masks, so security is enforced per role, not globally.
Editable Filtering Policies
Banned phrases, hard/bias enforcement modes, and penalty levels are all editable from the admin console. Policies are stored in the database and bridge down to resk-logits for logits-level filtering — dangerous content is not just flagged, it becomes statistically impossible to generate.
Multi-Provider Routing
Route requests to any OpenAI-compatible backend — OpenAI, vLLM, Ollama, or your own gateway — via the X-Provider-Id header or admin configuration. One firewall in front of every model you run.
Full Admin Console
Users, roles, policies, providers, agent sessions, logs, stats, and an audit trail, with a D3 network graph to visualize your deployment. Authentication uses JWT in httpOnly cookies with Argon2 password hashing and CSRF protection.
Try the Live Demo
A full deployment of ReskSafety is running at demo.resk.fr. Sign up with your email, explore the admin console, edit a filtering policy, and watch the firewall enforce it in real time.
Prefer to run it yourself? ReskSafety source-available under the RESK Software License — clone it from GitHub: Resk-Security/ReskSafety and start it with Docker Compose. The stack includes the FastAPI backend, a React 18 + Vite frontend, and PostgreSQL (SQLite for quick starts).
Where It Fits in the RESK Ecosystem
ReskSafety is the application layer of the RESK stack: resk-logits provides the token-level engine, reskSecure the per-user Python firewall, and ReskPoints the agent logging that ReskSafety bridges to. Explore all of them on our open-source tools page.