Llm Data Leakage in Gorilla Mux with Firestore

When an API built with Gorilla Mux serves data from Firestore and also exposes an endpoint used by or connected to an LLM-enabled client, there is a risk that sensitive Firestore documents are inadvertently returned in LLM responses. This can occur when route handlers return full Firestore documents—including fields such as internal IDs, administrative flags, or user PII—and those responses are simultaneously consumed by an LLM inference endpoint or logged as part of an AI interaction pipeline.

Gorilla Mux does not apply any filtering by default; it forwards the handler’s output to the caller. If a handler calls collection.Doc(docID).Data() and returns the raw map, an unauthenticated or overly permissive route can disclose contents that should be restricted. In a setup where those outputs are also routed to an LLM service—either through streaming responses, callback logging, or middleware that copies response bodies into prompt inputs—the exposed Firestore fields may appear in model outputs, chat transcripts, or error traces.

The LLM/AI Security checks in middleBrick specifically look for system prompt leakage, prompt injection attempts, and PII or secrets in model outputs. When Firestore data leaks into those outputs, middleBrick can detect patterns such as email addresses, API keys stored in document fields, or structured internal metadata that should never reach the model. Because Gorilla Mux routes are often organized around resource IDs and versioned paths, an attacker who can influence path parameters may escalate to retrieving documents that feed into LLM prompts, especially when authorization checks are absent or misapplied.

Additionally, Firestore documents sometimes contain nested arrays or maps that include sensitive keys like owner_id, role, or session_token. If a handler does not sanitize these fields before they are passed to an LLM-enabled logging layer, the model may inadvertently surface them in completions or expose them through tool-calling metadata. middleBrick’s output scanning looks for such PII and executable code in LLM responses, helping identify whether Firestore content is leaking through the LLM integration path.

To illustrate, consider a route defined with Gorilla Mux that retrieves a Firestore user profile and passes the result to an LLM backend for summarization. If the handler does not strip internal fields, the LLM may echo them in responses, and middleBrick can flag the presence of credentials or PII. This scenario highlights the importance of explicitly defining which Firestore fields are safe for LLM consumption and ensuring that only necessary, sanitized data traverses the pipeline between Gorilla Mux routes and AI components.

Remediation focuses on controlling what leaves the handler and what reaches the LLM pathway. Use explicit field selection when reading from Firestore, avoid returning raw document snapshots, and apply consistent sanitization before any data enters a logging or AI processing step.

Below are concrete Firestore code examples for Gorilla Mux handlers that demonstrate secure patterns.

1) Select only required fields and exclude sensitive metadata:

import (
	"context"
	"encoding/json"
	"log"

	"cloud.google.com/go/firestore"
	"github.com/gorilla/mux"
)

type PublicUser struct {
	DisplayName string `json:"displayName"`
	Email       string `json:"email"`
}

func getUserProfile(w http.ResponseWriter, r *http.Request) {
	vars := mux.Vars(r)
	userID := vars["userID"]
	ctx := r.Context()

	client, err := firestore.NewClient(ctx, <your-project>)
	if err != nil {
		http.Error(w, "internal error", 500)
		return
	}
	defer client.Close()

	iter := client.Collection("users").Where(firestore.DocumentID, "==", userID).Documents(ctx)
	for {
		doc, err := iter.Next()
		if err == iterator.Done {
			break
		}
		if err != nil {
			http.Error(w, "not found", 404)
			return
		}
		data := doc.Data()
		publicProfile := PublicUser{
			DisplayName: data["display_name"].(string),
			Email:       data["email"].(string),
		}
		w.Header().Set("Content-Type", "application/json")
		json.NewEncoder(w).Encode(publicProfile)
	}
}

2) Remove Firestore internal fields before LLM consumption:

func sanitizeForLLM(docMap map[string]interface{}) map[string]interface{} {
	safe := make(map[string]interface{})
	for k, v := range docMap {
		switch k {
		case "internal_admin_flag", "session_token", "firestore_document_id", "create_time", "update_time":
			continue
		default:
			safe[k] = v
		}
	}
	return safe
}

3) Use middleware to ensure all outgoing responses intended for LLM endpoints are scanned or transformed. While middleware cannot block, it can structure the payload to exclude sensitive keys:

func LLMSafeMiddleware(next http.Handler) http.Handler {
	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
		// wrap response writer if you need to inspect/modify body
		// ensure Firestore-specific sensitive keys are omitted
		next.ServeHTTP(w, r)
	})
}

By adopting these patterns, handlers reduce the chance that Firestore data reaches LLM endpoints in an uncontrolled form, aligning with the detection capabilities of middleBrick’s LLM/AI Security checks.