OSStegoGuard blocks steganographic prompt-injection in images before they reach vision-capable AI models. Its RecompressImage action decodes every upload, disrupts hidden LSB, DCT, and alpha-channel payloads via a lossy JPEG round-trip, and optionally adds a Gaussian blur to catch spatial-domain payloads that survive recompression. Handles 50+ formats including JPEG, PNG (with alpha), GIF (animated), WebP, TIFF (multi-frame), AVIF, HEIC, JXL, JPEG 2000, PSD, and camera RAW. Returns the cleaned bytes plus a per-channel LSB audit reporting detection technique and confidence, so security teams can log what was found. Non-image uploads pass through unchanged with IsPassthrough=true. Runs Layer 1 Priorities 2 and 3 of a defence-in-depth chain, complementing OSFileMetadataStrip (metadata). Protects apps that forward user files to LLMs or vision APIs from a class of attacks invisible to human reviewers and standard content moderators.
LSB detection - channel-fraction analysis; DCT, palette, and neural stego not explicitly detected, though JPEG round-trip disrupts many.False positives - noisy photos can push Confidence above 0.6 without a payload; review before blocking.QR codes - Reed-Solomon survives recompression; use OSQRGuard alongside.Alpha - JPEG round-trip on alpha may alter opacity by up to ~1%.Memory - no size limit; entire image loaded into memory.Animated WebP - libwebpmux not bundled; only first frame disrupted, others dropped.HEIC/HEIF - HEVC encoder is GPL; HEIC transcoded to JPEG; HEIF mif1 falls to passthrough.Camera RAW - decoded via dcraw; output transcoded to JPEG or requested format.Vector - SVG, WMF, MSVG rasterized to output format; vector source not preserved.PDF and non-images - returned as passthrough; embedded images not disrupted. Combine with OSFileMetadataStrip.Palette and bi-level - GIF, ICO, WBMP, XBM, JBIG have no LSB channel; recompression is a near-null-op.
OSStegoGuard is released under the MIT License.Copyright (c) 2026 AR.Permission is granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, subject to including the above copyright notice and this permission notice in all copies or substantial portions of the Software.THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND. THE AUTHORS ARE NOT LIABLE FOR ANY CLAIM, DAMAGES, OR OTHER LIABILITY ARISING FROM ITS USE.Bundled third-party dependencies retain their own licenses:- Magick.NET-Q8-AnyCPU 14.15.0 - Apache License 2.0. Ships the ImageMagick codec bundle used for decoding and encoding image formats.- OutSystems.ExternalLibraries.SDK 1.5.0 - OutSystems EULA. ODC target only.Full third-party notices ship in THIRD-PARTY-NOTICES.md inside the distributed package.