The 41 OpenRouter AI security checks Black Cat runs

Black Cat SSPM evaluates 41 security policies against your OpenRouter AI configuration on every scan, classifies each finding by risk, and provides remediation steps. Browse them by topic below.

How to connect OpenRouter AI — what access Black Cat needs, and why.

• Identity, MFA & sign-in

  3 checks · highest severity: medium

• Access control & privilege

  5 checks · highest severity: medium

• Data sharing & exposure

  9 checks · highest severity: high

• Configuration hardening

  23 checks · highest severity: medium

Identity, MFA & sign-in (3)

• Excessive Org Admins  · severity: medium
• Workspace Member Has Admin Role  · severity: medium
• SCIM Group Without Workspace Mapping  · severity: medium

Access control & privilege (5)

• Guardrail Without Provider Allowlist  · severity: medium
• Guardrail Without Model Allowlist  · severity: medium
• BYOK Credential Without Workspace Scope  · severity: medium
• SCIM Group Grants Admin Role  · severity: medium
• SCIM Group Mapped to Default Workspace  · severity: medium

Data sharing & exposure (9)

• Prompt/Response Logging Enabled  · severity: high
• Logging At Full Sampling  · severity: high
• Observability Broadcast Enabled  · severity: medium
• Data-Discount Logging Enabled  · severity: high
• LLM Data Exported To External Sink  · severity: high
• Guardrail Without Zero Data Retention Enforcement  · severity: high
• Guardrail With Partial Zero Data Retention Enforcement  · severity: medium
• Guardrail Allows Training Data  · severity: high
• Permissive Privacy Posture  · severity: medium

Configuration hardening (23)

• API Key Without Spend Limit  · severity: medium
• API Key Without Expiry  · severity: medium
• Disabled API Key Not Deleted  · severity: low
• Stale API Key  · severity: medium
• BYOK Spend Uncapped  · severity: medium
• API Key Spend Limit Without Reset Interval  · severity: low
• API Key Relies Solely On Workspace Default Guardrail  · severity: medium
• Workspace Without Guardrails  · severity: medium
• Workspace Without Spending Budget  · severity: low
• Guardrail Without Content Filters  · severity: medium
• Guardrail Without Key Or Member Assignments  · severity: medium
• API Key Sprawl  · severity: low
• BYOK Credential Disabled Not Deleted  · severity: low
• BYOK Spend Ungoverned  · severity: medium
• Excessive BYOK Provider Diversity  · severity: medium
• Workspace Has Excessive Members  · severity: low
• SCIM Mapping Stale  · severity: low
• Preset Targets Model Outside Workspace Allowlist  · severity: medium
• Disabled Preset Not Deleted  · severity: low
• Stale Preset  · severity: low
• Stale File  · severity: low
• Oversized File  · severity: low
• Excessive Model Diversity  · severity: medium

Other checks (1)