Skip to content
VecShield

VecShield

Open-source security tooling for RAG and vector stores.

Inspect the data, access controls and retrieval behavior behind RAG applications.

VecShield helps identify:

  • RAG poisoning and stored prompt injection
  • missing provenance
  • sensitive data stored in vector databases
  • cross-tenant retrieval
  • excessive vector-store permissions
  • anomalous embeddings
  • collection enumeration and bulk retrieval
  • insecure vector-store configuration
View on GitHubRead the documentation

Self-hosted · No telemetry · Safe mode by default

RAG security does not begin at the prompt.

Content reaches the model through ingestion, storage and retrieval. Each step can introduce attacker-controlled text, leak data across tenants, or expose a collection. VecShield examines the vector store and the retrieval path.

  1. 01

    Sources

    Documents, tickets, wikis

    • Poisoned document
  2. 02

    Ingestion

    Chunk · embed · write

    • Missing provenance
  3. 03

    Vector store

    Chunks, metadata, embeddings

    • Sensitive data
    • Tenant leakage
    • Anomalous vectors
  4. 04

    Retrieval

    Similarity search, filters

    • Enumeration
    • Malicious context
  5. 05

    LLM

    Answer generation

    Highlighted: the parts of the pipeline VecShield examines.

    Run VecShield

    $ git clone https://github.com/Vecshield/vecshield
$ cd vecshield/demo
$ docker compose up --build

    The demo includes a synthetic estate and the full console at 127.0.0.1:8088. A generated admin password is printed on first boot.

    • Docker
    • Kubernetes / Helm
    • Terraform
    • Air-gapped

    VecShield runs alongside the vector infrastructure you already use. Scans and findings stay inside your environment.

    What VecShield examines

    RAG integrity

    Stored prompt-injection indicators, suspicious chunks, provenance gaps and anomalous embeddings.

    Data exposure

    Personal, health, payment and credential data stored in chunks and associated metadata.

    Tenant isolation

    Checks whether one tenant or namespace can retrieve data belonging to another.

    Vector-store posture

    Network exposure, TLS, encryption settings, known vulnerable dependencies and configuration issues.

    Access

    API keys, excessive permissions, stale credentials and access-control mismatches.

    Retrieval behavior

    Bulk reads, enumeration attempts and unusual collection-wide retrieval patterns.

    RAG Security Notes

    Research, experiments and practical notes on securing retrieval-augmented systems.

    View all research →

    What are we trying to defend?

    VecShield focuses on attacks and failures around the retrieval layer: poisoned knowledge, data leakage across tenants, and extraction of a whole collection through queries.

    Poisoning

    1. Attacker-controlled content

    2. RAG ingestion

    3. Poisoned knowledge base

    4. Malicious / incorrect retrieval

    5. LLM

    Data leakage

    1. Tenant A query

      One tenant's request

    2. Vector store

      Shared collection

    3. Tenant B chunk

      Cross-tenant data exposure

    Collection extraction

    1. Repeated semantic queries

    2. Progressive recovery

      Content collected across queries

    3. Stored knowledge

      Collection contents extracted

    VecShield focuses on the retrieval and vector-store layer. It is not a generic LLM jailbreak detector.

    Read the threat model →

    Works with the vector infrastructure you already use

    • Chroma
    • pgvector
    • Pinecone
    • Qdrant
    • Weaviate
    • Milvus
    • Redis
    • OpenSearch
    • MongoDB
    • OpenAI vector store
    • Azure AI Search
    • Amazon Bedrock Knowledge Bases
    • Vertex AI

    Architecture

    Connectors read from your vector stores. Optional monitoring records retrieval events. Detectors turn both into findings for data exposure, RAG integrity and access posture.

    VecShield runs in your environment and does not require sending vector-store contents to a VecShield-hosted service. Scans run against the store on their own schedule, not between your application and its queries.

    Read the architecture →
    VecShieldInside your environment

    Vector stores

    Connectors

    Read-only inspection

    Retrieval events

    Monitoring

    Optional event capture

    Detectors

    Data exposure · RAG integrity · access posture

    Findings & evidence

    Coverage, masked previews and audit records

    Security tools should say what they don't know.

    A result states what was scanned, what was sampled, what was skipped, what evidence supports a finding, what evidence argues against it, and what the detector cannot conclude. When a check samples a collection instead of reading all of it, the result is marked partial. There is no overall score.

    Coverage
    What the assessment actually examined.
    Counter-signal
    Evidence that weighs against a finding.
    Withheld
    A recommendation VecShield deliberately does not make because available evidence is insufficient.

    Detection is not a legal determination. VecShield produces evidence; humans make the final decision.

    Interested in the project?

    GitHubRead the docs