Using the safety checks without over-trusting them

Pick the checker that matches the channel

There are three tools, and they are not interchangeable. Use the prompt injection scanner on text that is about to enter a model from a user, a file, a page, or a tool. Use the jailbreak detector on a prompt that may be trying to drop safety rules. Use the output checker on text a model already wrote, before you store it or pass it on. The matching guides walk through each rule: prompt injection, jailbreaks, and output red flags.

If you only have time for one question, ask where the text came from and where it will go. Text you wrote as the system prompt will trip role language on purpose. Text a stranger’s website contributed should not get to appoint a role or to send the conversation away. Text the model produced should be treated as data until a person accepts it.

How a score is built

Each matching rule adds a fixed weight and carries its own severity: low, medium, high, or critical. The number you see is the sum of those weights, capped at 100. At most 12 findings are shown, after sorting by weight. A paste longer than 20,000 characters adds one extra low-severity finding that says the tail was not scanned, and that finding counts toward the cap and the sum.

The colored label is the more severe of two values: the band for the number, and the severity of the strongest finding. The bands are 1–24 low, 25–49 medium, 50–74 high, and 75–100 critical. A single critical finding keeps the label at critical even when the number has not reached 75. A pile of lower findings can also push the number into a higher band. The label never drops below the strongest line. One mild line cannot “average away” a critical one.

An empty box is not a clear security result. The page asks you to paste something. A box that matches nothing, and is under the length cutoff, is the only fully clear result, and the summary on that result says it does not prove the text is safe. Believe that sentence.

A clear result is a narrow statement

Clear means this rule list found nothing in the characters it read. It does not mean a person, a policy, or another product would agree. It does not mean the text is accurate. It does not mean a later paraphrase will also be clear. It does not cover characters past the cutoff, words in languages the patterns ignore, instructions drawn inside an image, or a harmful request written in ordinary prose.

The tools are not a moderation layer for crime, sexual content, self-harm, or harassment. Those topics can appear in a paste and score clear, because the rules are about injection wording, jailbreak wording, secrets, and a few high-cost phrases. If your product needs a policy on those topics, you need a policy. A keyword score is not one.

The tools are also not a medical device, a legal opinion, or a certification of any model. Nothing on this site is a leaderboard of which model is safe. Older pages in the background library are notes and archives. They are not an input to these scores.

False positives are part of the design

The rule lists prefer a quote you can dismiss over a silent miss of a famous pattern. That choice has costs, and the other guides name them. The expensive ones are worth repeating here so a team does not automate them.

The jailbreak detector treats the name Dan as a critical persona match. It treats “no restrictions” as a high-severity phrase, including in pricing copy. It treats “you are the villain” as a harmful role-play wrapper. The injection scanner treats “new instructions,” a leading SYSTEM: label, and “do not tell the user” as findings, including when those sentences are your own policy. The output checker treats “do not stop taking your prescribed medication” as a medical hit, and “enter your password on the bank’s site” as a request for a password, because neither rule understands negation.

If you automate a ban from these labels, you will ban Dan, your own runbooks, and a certain amount of fiction. If you automate approval from a clear label, you will approve anything that avoided the phrases. Keep a person in the loop for both directions until you have a policy you are willing to defend without this site.

A workflow that fits the tool

Name the channel. Paste. Run the matching checker. Read every quote, not just the badge. Decide in your own tracker. Clear the box. If the document is longer than 20,000 characters, scan the rest as a second paste and remember that each paste is independent.

Do not paste a live production secret into an ad-supported page to “check it.” Revoke the secret and review the surrounding text somewhere you control. The check itself is JavaScript on the page: running it does not upload the textarea, and there is no model API behind the button. Saving a scan is optional after you sign in, and the full paste is stored only if you opt in. Advertising scripts loaded on tool and guide pages share the tab, which the privacy policy states directly. Theme choice, a signed-in session, and a local daily check counter are the values this site writes to local storage. The counter is a number, not the paste.

When a finding is real, the action is usually outside the tool. Take the untrusted sentence out of the instruction role. Strip control tokens before you reuse model output. Revoke a key that leaked. Do not file a system prompt in a public ticket. Ask a person before a tool sends data off the machine. When a finding is a false positive, dismiss that quote and move on. You do not need the site to store that dismissal.

What we will not pretend

MisalignAI is an independent site. The checkers and these guides are written by the publisher described on the about page. There is no review program, no traffic number, and no customer quote on these pages. There is no claim that the rules catch attacks published after they were written.

The background library still contains older incident notes, essays, and an archived headline index. Those pages are not the product, and they are not evidence about the quality of the checkers. If a guide and a checker disagree, the checker’s code is the behavior and the guide is wrong. Please send the correction to contact@misalignai.com.

A useful report names the rule and includes a redacted sentence that should or should not match. It does not include a live key, a full customer transcript, or a request for help attacking a system you do not own. The tools stay client-side. We are not going to add a paid model behind them in order to make the badge look more confident.