LoFP LoFP / gcp_vertexai

gcp_vertexai rule

TitleTags
aggressive safetysettings (for example block_low_and_above) on red-team or content-moderation workloads can produce frequent safety finishes. exclude those projects or models, or require concurrent high/medium ratings.
approved batch evaluation clients or shared nat egress. raise the threshold or exclude known source ip prefixes.
approved batch evaluation or high-traffic applications. raise thresholds above the normal peak per model.
approved platform engineering changes that update publisher logging destinations. confirm the actor and change ticket.
approved red-team or evaluation prompts that deliberately include jailbreak strings. exclude known test principals or lower severity for those models.
approved red-team suites that intentionally elicit refusals. exclude those models or raise the threshold.
approved research projects that document block_none for evaluation. prefer labeled service accounts and exclude those principals.
borderline creative-writing or news-summarization prompts can occasionally score medium. confirm category and prompt text before escalating.
developers, notebooks, and ci service accounts execute sandbox code from new offices, home isps, or cloud egress asns until baselined. exclude known build and research identities after review.
distributed ci or multi-region automation that shares one service account across distant egress ips. prefer per-region identities, or raise distance and speed thresholds.
documentation and unit tests that paste example keys (for example an aws access key ending in example) match the token patterns. confirm the value is live before rotating it.
shared service accounts used by multi-region ci, build agents, or dual-homed vpn/cloud egress can span several countries. prefer per-region identities, or exclude known automation principals.
vpn or cloud egress that geolocates incorrectly or jumps between distant pops. validate the ip locations before rotating credentials.
vpn or proxy egress that geo-resolves through hubs far from the caller's physical location. corroborate with asn and user-agent diversity before rotating credentials.