Implements bidirectional sanitization that redacts sensitive data (API keys, credentials, PII) before sending prompts to AI providers and restores original values in responses. Also detects and neutralizes prompt injection patterns. The component is self-contained (no external dependencies beyond JDK), uses regex patterns for different data categories, maintains mapping between placeholders and original values, and could be extracted for use in any application interacting with LLMs where data privacy is a concern.

Provides robust parsing of AI-generated JSON responses that handles common LLM output issues like markdown code fences, single objects instead of arrays, and malformed JSON. Implements multiple fallback strategies to extract valid JSON from AI responses before parsing into structured finding objects. While it has a light dependency on the internal OwaspCategory enum (easily replaceable), the core JSON parsing logic demonstrates non-obvious skill in dealing with the unpredictability of LLM outputs and could be reused in any application that needs to reliably extract structured data from AI-generated text.

Defines a clean interface abstraction for LLM providers that allows seamless switching between different AI services (Burp AI, Ollama, OpenAI, Claude, Gemini, Azure) while handling provider-specific details uniformly. The interface includes methods for availability checking, model listing, analysis execution, and connection testing. With only minimal dependencies on simple internal types (ProviderId enum and TestResult record), this component demonstrates good application of the strategy pattern and could be extracted with minimal modification for any application needing to abstract over multiple LLM or API providers.