Extra implementation details for anyone curious: - The engine is dual-layer: - L1: regex rules (explainable + fast) - L2: EmbeddingGemma-300M based, INT8 q

Extra implementation details for anyone curious: - The engine is dual-layer: - L1: regex rules (explainable + fast) - L2: EmbeddingGemma-300M based, INT8 quantized ONNX classifier (CPU), with 5 heads: 1) is_threat 2) threat_family 3) severity 4) primary_technique 5) harm_types (multilabel) - Offline mode: You can run completely without network - Telemetry is detection metadata only (e.g., prompt_hash + rule_id + severity + duration). Raw prompts and matched substrings are never sent. Happy to answer anything / take feature requests.