Building a "Semantic" API Proxy: How I handled privacy and 200 OK "Lies"

I’ve spent the last few weeks building Inspekt, an AI-powered proxy that tells you why an API failed instead of just giving you raw logs. I hit 100 upvotes on Product Hunt today, and the "Day 1" feedback has already forced me to rethink my architecture. The "200 OK" Problem: Standard monitors only trigger on 4xx/5xx codes. But what about GraphQL or certain REST APIs that return a 200 OK with an errors array hidden in the payload? Inspekt solves this by analyzing the semantic meaning of the response. It doesn't just look at the status code; it audits the entire exchange. Update 01: The "Visibility & Trust" Patch Based on community feedback today, I just pushed a major update to the proxy logic. Local Privacy Scrubbing I realized I shouldn't be sending raw Authorization or Cookie headers to an LLM. The Fix: I implemented a local scrub() utility. Before the data leaves the server for analysis, it redacts sensitive keys. Your credentials stay on the proxy; the AI only sees [REDACTED]. Tran