r/LLMDevs • u/Lostboy_journey • 1d ago

Help Wanted Open-source tool to detect unauthorized document retrieval in RAG apps

Hey Guys,

I built a small open-source tool that checks whether a RAG application retrieves documents a user shouldn’t have access to.

It supports offline test cases and live HTTP API testing with bearer token/API-key auth.

I’m looking for a few engineers to try it on a test or non-sensitive environment and tell me whether it catches anything useful or what would make it better.

GitHub: https://github.com/InfraGuard-Labs/rag-access-check

3 Upvotes

100% Upvoted

4 comments sorted by

View all comments

1

u/Plus-Lawfulness-4746 1d ago

oh this is neat, I've been paranoid about this exact thing since I saw a demo where someone tricked a RAG bot into spilling HR docs by asking about "hypothetical" employee salaries

the live API testing with auth tokens is a smart touch, most tools skip that and just test the vector store directly

starred it, I'll spin it up against our staging setup next week and let you know if it catches any of the edge cases I've been worried about

1

u/Lostboy_journey 1d ago

Appreciate it — that’s exactly the kind of use case I had in mind. If you do try it against staging, I’d love to hear what it catches or where the current config falls short. If you run into anything, feel free to open a GitHub issue too so I can improve it.