> ## Documentation Index > Fetch the complete documentation index at: https://docs.promptguard.co/llms.txt > Use this file to discover all available pages before exploring further. # Known Limitations > An honest list of what Shadow AI does not cover — certificate-pinned apps, QUIC/HTTP-3, remote-image references, and the host-allowlist coverage model — plus how to request a vendor. We'd rather be upfront than over-promise. Here's what Shadow AI does **not** do today, and how to work around each one where you can. ## Certificate-pinned apps Some native desktop apps pin their own certificate and reject any certificate they didn't ship with — including the agent's CA. Those apps bypass the inspection proxy entirely and are **out of scope by design**. We never silently fail open on a tool we *do* cover — pinned apps simply aren't inspected at all, rather than being inspected unreliably. There is no device-side workaround; coverage there depends on the app vendor. ## QUIC / HTTP-3 The agent intercepts HTTP/HTTPS through a local proxy. **QUIC / HTTP-3** runs over UDP and can route around an HTTP proxy, so that traffic can reach an AI vendor without inspection. Chrome and some Google properties (including Gemini) prefer QUIC. **Mitigation:** disable QUIC via browser policy (for Chrome, the `QuicAllowed=false` enterprise policy). The browser then falls back to HTTPS over the proxy and inspection resumes. See [Troubleshooting](/shadow-ai/troubleshooting#gemini--chrome-traffic-slips-past). ## Multimodal coverage The agent inspects more than prompt text. Alongside text extracted from **PDF, DOCX, XLSX, and plain-text** attachments, it now also forwards: * **Inline images** — a screenshot of a credential pasted into ChatGPT, Claude, or Gemini is extracted and sent to the engine, which runs OCR server-side. * **Inline voice / audio clips** — transcribed engine-side and scanned like text. * **Inline file attachments** — a secret inside an attached PDF/DOCX/XLSX/text file is recovered and scanned like prompt text. Two nuances to be aware of: * **Remote image references are not fetched.** If a request points at an image by URL (`https://…`) rather than embedding it inline (`data:…;base64,…`), the agent does not download it to inspect it. Nearly all paste/upload flows embed the bytes inline, so this is an edge case. * **Media-bearing requests fail closed.** Because image and audio bytes can't be redacted in place, a request that carries media and trips a **redact** verdict is **blocked** outright rather than forwarded with a partial edit. Use an approved exception grant if you need to send it. ## Coverage is a host allowlist Shadow AI works from a maintained **host allowlist** of known AI vendors — it inspects traffic to those hosts and leaves everything else untouched. This bounds what's inspected (and what it costs), but it means a vendor we don't yet recognize passes through without a verdict. The current allowlist covers: * ChatGPT / OpenAI * Claude / Anthropic * Google Gemini * Perplexity * Mistral * Cohere * Microsoft Copilot * GitHub Copilot * Cursor * DeepSeek * Grok (x.ai) * Poe * HuggingChat * Meta AI ### Requesting a vendor Adding a vendor to the allowlist is a small config change on our side — not a new build for you to deploy. To request one, email [support@promptguard.co](mailto:support@promptguard.co) with the vendor and the hostnames its app or API uses. ## Platform availability All three platforms are downloadable today from [promptguard.co/download](https://promptguard.co/download): | Platform | Status | | ----------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | **macOS** | Generally available — universal build, signed + notarized | | **Windows** | Early access — the installer is **not yet code-signed**, so SmartScreen warns on first run (**More info → Run anyway**). Verify the SHA-256 checksum from the release before installing. Certificate trust is per-user, not machine-wide | | **Linux** | Available — `.AppImage` and `.deb`. Automatic proxy configuration targets GNOME (`gsettings`); on other desktops you may need to set the proxy manually, and browser certificate trust uses the shared NSS database (`libnss3-tools` required) | ## Next steps Diagnose interception gaps and engine reachability. What's inspected, logged, and what leaves the device.