Engineering Blog
Technical notes from the Tamga engineering team on LLM security, PII detection, KVKK compliance and inline proxy architecture. Every post ties back to a decision in the open-source codebase or a field note from a design-partner deployment.
Manual red-team testing doesn't scale. We built a single-command stress suite that runs 4 adversarial bypass categories + k6 load tests, checks for regressions against a baseline, and blocks PRs that degrade detection. Here's how.
Tamga started with 4 SDK methods wrapping a 67-endpoint API. Over a single sprint, we expanded both the Python and TypeScript SDKs to cover the full surface — including SCIM, billing, policy CRUD, and live SSE streaming.
An LLM proxy handles every API key in your AI stack. Storing them as environment variables works for prototypes. For production — especially in regulated environments — you need external secret storage with audit trails and rotation.
Most teams focus on the model weights. The real attack surface is the prompt-to-output pipeline — a multi-hop supply chain where every hop is a trust boundary.
Turkish identity numbers (TCKN) carry a checksum that most DLP tools ignore. Credit cards need BIN/IIN validation to avoid false positives on internal 16-digit IDs. Here's how we built native TR PII detection.
Every LLM request that passes through Tamga generates an audit event. We needed a way to stream those events to the dashboard in real time without WebSockets. SSE turned out to be the right answer.
Tamga's DFA scanner catches most PII in under 1ms. But when you need contextual understanding — distinguishing a real credit card number from a code snippet — you need ML. Here's how we run Piiranha as an async shadow sidecar.
Stay updated
We publish posts on GitHub. Watch the repo, or write to us for an RSS/Atom feed.
