5.6Continuous Production Monitoring for Data Leakage

Deploy the scanner as a production pipeline that monitors live responses:

# production_leakage_monitor.py
from data_leakage_scanner import DataLeakageScanner
import structlog

log = structlog.get_logger()
scanner = DataLeakageScanner()

def monitor_response(request_id: str, user_id: str, response_text: str):
    """Scan every production LLM response for data leakage."""
    result = scanner.scan_response(response_text)

    if result["has_leakage"]:
        log.error("data_leakage_detected",
                  request_id=request_id,
                  user_id=user_id,
                  finding_count=result["finding_count"],
                  severity_max=result["severity_max"],
                  findings=result["findings"])

        # For critical findings, trigger immediate alerting
        if result["severity_max"] == "critical":
            trigger_security_alert(
                severity="critical",
                summary=f"Data leakage detected: {result['finding_count']} findings",
                request_id=request_id,
            )

    return result