Limitations & honesty

SDK & CLI packages

@noeticguard/core and the CLI are not on the public npm registry yet. Source of truth is the private monorepo (file: links) or a support tarball. See the SDK quickstart.

Media Guard vs SDK

Media Guard blocks image/file uploads and paste in Browser Shield (DOM / network path). It is not an @noeticguard/core detector: the SDK masks text strings; it does not intercept browser uploads. There is no OCR and no media bytes sent to NoeticGuard.

Brand Guard reply

Brand Guard reply mode (guardBrandReply) soft-scrubs dictionary hits in model output. It does not rewrite intent with another LLM, block recommendations by semantics, or change ChatGPT assistant bubbles in Shield. Pair with a system prompt; treat reply scrub as a post-generation safety net.

Pack force-on locks

Resolution order: Policies default_rules, then enabled_packs force-enable kinds, then Brand Guard dictionaries, then optional custom_regex (applied by the core engine). Example: PCI / Financial keeps card + IBAN masked even if Financial Data toggles are off. That is intentional while the pack is Active — not a UI bug.

Incognito & MDM

Chrome does not run extensions in Incognito by default. If employees open private windows and IT does not set policy, Shield cannot see that traffic. Enterprise mitigation: disable Incognito (or require Allow in Incognito) + force-install + dashboard Shield Required — see MDM & Chrome Enterprise.

Certifications

Industry packs (PCI, HIPAA, COPPA presets) turn on detector kinds for LLM egress. They are not PCI DSS, HIPAA, or COPPA certifications or QSA assessments.

Mobile clients

Do not ship long-lived API secrets inside mobile apps. Prefer a backend-for-frontend (BFF) that masks with @noeticguard/core before calling an LLM. Publishable ng_pub_ keys are for Shield / browser policy sync — not a substitute for a secure mobile secret store.

Account email change from the dashboard remains support-assisted for now.