# YARA / Heuristics

The `yara` scanner and the accompanying rules act as heuristics detection. Submitted prompts are scanned against the rulesets with matches raised as potential prompt injection.

Custom rules can be used by adding them to the `data/yara` directory.

### Default rules

* System Instructions
* API tokens
* IPv4 address
* Instruction bypass phrases
* Guidance terms