CoTStripProxy

Who it's for

SaaS and internal-tool builders shipping o1/o3-style features who currently either disable reasoning or manually scrub logs and Sentry; substitute is ad-hoc middleware or hope

The problem

legal — accidental disclosure of proprietary reasoning can void trade-secret claims and breach customer contracts; also incident-response time

How to build it

hosted proxy + self-hostable binary, OpenAI SDK baseURL swap only, optional log-drain filter

How it makes money

engineering managers pay $79/seat/mo for hosted proxy + 90-day signed audit retention because free self-host leaves them without lawyer-ready evidence when a leak is alleged

Why it doesn't exist yet

providers benefit from traces remaining visible for their own distillation and eval and have no incentive to default-strip; the gap is a customer-controlled auditable strip layer that ships faster than enterprise DLP

First users

engineers who upvoted or commented on the stolen-thoughts HN thread and already run an internal gateway

Build size

1 person x 4 weeks: core reverse-proxy, redaction rules for OpenAI/Anthropic/Google thinking fields, per-call SHA hash export, basic usage dashboard; excludes routing, rate-limits, or prompt-injection defense

Biggest risk

OpenAI or Anthropic ships a native strip_reasoning=true parameter with signed redaction receipts

Conditions for a hit (all 3 required)

• Given a standard chat-completion request, returns identical response JSON minus any reasoning_content/thinking/CoT fields with <150ms p95 overhead
• Emits a verifiable SHA-256 of the exact stripped bytes tied to request_id for every call, downloadable as JSONL/CSV
• Works as drop-in baseURL for official OpenAI Python and JS SDKs with no other code changes

How it's judged (in 6 months)

GitHub >=750 stars or Product Hunt daily top 5 or public revenue >=$3k MRR(judgment date 2027-02-12)

AI self-confidence 45/100 — self-reported likelihood of meeting the criterion, not a business success rate