The security advantages of local-first are significant:

Independent instances. Each developer's Pretense instance stands on its own. A compromise of one instance stays confined to that one developer's machine.

Per-developer API keys. Each developer uses their own API keys. Keys stay distributed across machines, so there is zero centralized key store to target.

Mutation before transit. Even if the network is compromised (man-in-the-middle, compromised VPN, malicious WiFi), the attacker sees only synthetic identifiers. The real code stays on your machine.

Open source and auditable. Hosted proxy services ask you to trust the provider's security claims. Pretense's code is fully auditable, so you can verify exactly what it does with your data.

---

The Real-World Impact

Consider two organizations, both using AI coding tools:

Organization A routes all AI traffic through a hosted LiteLLM instance. A CVSS 9.6 vulnerability is disclosed. Until they patch (which requires testing, staging, and production deployment -- typically 2-7 days for critical patches), all their AI traffic is exposed. Every developer's prompts, every piece of code, every API key.

Organization B uses Pretense on each developer's machine. Even if a vulnerability were discovered in Pretense (all software carries that possibility), the impact stays contained: only that developer's synthetic identifiers are exposed, and those identifiers are meaningless to anyone who lacks the local mutation map.

// Organization A: what the attacker sees through the LiteLLM vulnerability

class FraudDetectionPipeline {
  private mlModel: XGBoostFraudModel;
  private velocityChecker: TransactionVelocityAnalyzer;

  async evaluateTransaction(txn: Transaction): Promise<FraudScore> {
    const features = await this.extractFeatures(txn);
    const mlScore = await this.mlModel.predict(features);
    const velocityScore = await this.velocityChecker.check(txn);
    return this.combineScores(mlScore, velocityScore, txn.amount);
  }
}

// Organization B: what any interceptor sees (Pretense mutation applied)
// Synthetic identifiers, architecture hidden

class _cls4f2a {
  private _v3b1c: _cls7d4e;
  private _v8a2f: _clsb3c1;

  async _fn2c3d(_v1e5f: _cls6a7b): Promise<_cls9d8e> {
    const _v5f6a = await this._fn4a2b(_v1e5f);
    const _v7b8c = await this._v3b1c._fn8c9d(_v5f6a);
    const _v2d3e = await this._v8a2f._fn1a2b(_v1e5f);
    return this._fn6f7a(_v7b8c, _v2d3e, _v1e5f._v3e4f);
  }
}

---

Lessons for AI Infrastructure Security

The LiteLLM vulnerability teaches three lessons:

1. Minimize the blast radius. Centralized AI proxies create centralized risk. Local-first architecture limits the impact of any single vulnerability to a single developer's synthetic data.

2. Treat the network as hostile. Even if your proxy is perfectly secure today, network paths carry their own risk. Mutation protects data in transit regardless of the security posture of intermediate systems.

3. Trust but verify. Open-source, auditable code is the most direct way to verify security claims about data handling. Hosted services ask you to trust their security team. Open source lets you check for yourself.

Pretense was built on these principles from day one. It is local-first, open-source, and treats every network path as potentially hostile. Your code is mutated before it touches any wire, any proxy, any third-party service.

Protect Your Code Today

Pretense is the AI firewall that mutates proprietary code before it reaches any LLM API. Install in 30 seconds and protect your team's intellectual property.

curl -fsSL https://pretense.ai/install.sh | sh
pretense init
pretense start