Best Practices

Bleep Individual is a single desktop app that runs a DNS redirect service, detection engine, and UI on one machine. It protects all AI traffic — browsers, MCP servers, IDE agents, CLI tools, and any other application — automatically via DNS interception. No proxy configuration needed. These recommendations help you get the most out of it.

1. Initial setup

Certificate

Bleep generates a local CA certificate on first launch. The CA must be trusted by your operating system for HTTPS inspection to work. Bleep handles this automatically on most systems, but verify by visiting any AI service in Chrome and confirming you see a green lock icon.

• Firefox uses its own certificate store - import the CA manually via Settings → Privacy & Security → Certificates
• Java applications use a separate keystore - import with keytool -importcert if needed
• Corporate environments may block CA trust changes - check with IT first

Verify protection

After launching, confirm DNS redirect is active:

# Verify DNS is redirected (should resolve to a local address)
nslookup api.openai.com 127.0.0.1

# Verify system DNS is set to 127.0.0.1
# Windows: ipconfig /all | findstr "DNS"
# macOS/Linux: cat /etc/resolv.conf

AI domains should resolve to a local address. Non-AI domains resolve normally. No port configuration is required.

2. Rollout strategy

Bleep uses a mode-as-cap model. The mode sets a ceiling on what actions policies can take - Warning mode caps everything at Warn, Enforcing mode uses the full policy action.

1. Start in Warning mode (the default). All violations are logged and you receive desktop notifications, but no traffic is blocked or redacted.
2. Run for a few days and review violations in the app UI. Look for false positives - patterns matching non-sensitive data.
3. Tune patterns. Disable or tighten any pattern that generates false positives. Add custom patterns for org-specific secrets.
4. Switch to Enforcing when confident. Policies now take full effect - for example, a "Block Critical" policy will block matching traffic, and a "Redact High" policy will redact in-flight.

3. Pattern management

Built-in patterns

Bleep ships with detection patterns for common secrets. All are severity HIGH by default:

Custom patterns

Add patterns for your organization's secrets in the YAML config or through the app UI. Each pattern needs a name, regex, severity, and optional tags for policy matching.

custom_patterns:
  - name: "Internal DB Password"
    regex: "db_pass_[A-Za-z0-9]{16,}"
    severity: CRITICAL
    tags: ["database", "internal"]

Blocklist

Use the Blocklist for known sensitive values (specific API keys, passwords, internal secrets). Unlike detection patterns which match categories via regex, blocklist items match exact text. Values are encrypted at rest and never shown in full.

Same-origin suppression

Built-in patterns automatically suppress false positives when credentials are sent to their own service — for example, an OpenAI API key sent to api.openai.com is not flagged, since that's its intended destination. This reduces noise without any configuration.

Tuning false positives

• Tighten the regex to be more specific (e.g. require a prefix or exact length)
• Use the blocklist to flag specific exact values (e.g. a known internal secret) by pasting them directly - they’re matched by literal substring
• Disable patterns you don't need - fewer active patterns means fewer false positives and better performance

Redaction style best practices

• Use Type Label for audit trails - When reviewers need to know what type of data was removed, Type Label mode (e.g., [AWS_SECRET_KEY]) provides clear context without exposing the actual value.
• Use Partial Masking for identifiers - For credit card numbers, phone numbers, and account IDs, masking with the last 4 characters visible (e.g., ************1234) helps users verify which record is affected.
• Use Fixed Text for blanket redaction - When the data type doesn't matter and you want consistent replacement text (e.g., [CONFIDENTIAL]), Fixed Text mode keeps things simple.
• Default is fine for most patterns - The built-in [REDACTED] works well for general-purpose detection. Only customize when there's a specific need for differentiation.

4. Monitoring

• Check violations regularly in the app UI. Filter by action type (Block, Redact, Warn, Log) to focus on what matters.
• Violation previews are redacted - the actual sensitive data is never stored, only the pattern name and match location.
• File scanning detections (images via OCR, PDFs, Office documents, text files) appear as normal violations with the same severity and action handling.
• Desktop notifications are enabled by default and fire on every violation. Disable in app settings if they become noisy.

5. Performance

Interception latency

Bleep adds 2-4ms average overhead per request — approximately 1-2% increase over direct connection latency. Effectively imperceptible.

Benchmarked with 100 sequential requests to api.openai.com. Built in Rust — no garbage collection pauses, consistent P99 latency. Image OCR adds 100-500ms per image when triggered but only activates for base64 images in request bodies.

File scanning

Bleep scans images (OCR), PDFs, Office documents (DOCX, XLSX, PPTX), RTF, and text files — all locally with no external API calls. Image OCR uses embedded ML models. Document extraction is lightweight (ZIP + XML parsing). Disable with image_scanning: false in config if not needed.

General

• Only traffic to monitored AI domains is intercepted — all other DNS queries are forwarded to the upstream resolver transparently
• Toggle response_inspection off if you only need to scan outbound requests

6. Keeping current

• The domain list updates automatically on each launch. Updates use merge-based sync - your custom domain additions and removals are preserved.
• App updates are manual. Check the downloads page for new versions.

7. License

• Your license is validated via heartbeat every hour. If the app cannot reach the license server, a 7-day offline grace period allows continued operation using a cached license.
• After 7 days without verification, protection stops. Restore connectivity to resume.
• Licenses are instance-bound. If you move to a different machine, the app will detect the conflict and show a "Move License to This Device" button to rebind — no need to contact support.