Without Daybreak access
Developer review, dependency checks, automated tests and other permitted security tools form the review process.
Security
Security, before
the release.
How I approach access, data and release decisions. The controls for a client project are agreed around its actual requirements.
Start with the data.
Before choosing a model or a hosting service, we establish what information the product needs, who should have access and where it can be processed.
That informs the architecture, permissions and testing. It also makes the limits clear before the product is in use.
AI defence in development
OpenAI
Daybreak Blue.
I have access to OpenAI Daybreak Blue for authorised defensive security work. Within the scope of that access, it gives me another way to examine code, assess risks and review proposed fixes.
What access changes
With approved Daybreak access
AI support with safeguards calibrated for defensive work can help trace security concerns across code, question assumptions and check a proposed fix.
What matters to your users
Can someone see another customer’s records? Are account permissions checked on the server? Does a fix hold up in testing? Those are the questions that shape the work.
I assess new AI defence tools as they become available. I review their findings and remain responsible for the code I ship. Project checks are agreed around the application, its data and the permitted scope of each tool.
OpenAI’s Daybreak documentationAccess with a purpose
Use the permissions needed for the job. Keep credentials out of public source and browser code. Remove access when the work no longer requires it.
Deliberate data handling
Collect what the feature needs. Agree retention and provider requirements. Use representative test data where live information is unnecessary.
Review before release
Check changed behaviour, dependencies and the production build. Keep a version history so a release can be traced and an earlier version restored.
AI with boundaries
Define what an agent may read and do. Put review steps around consequential actions and test its behaviour against realistic examples.
This website
Khadaffi.com is delivered through AWS Amplify over HTTPS. Public pages use self-hosted fonts and icons. There are no advertising trackers in the site code.
The enquiry form uses EmailJS. The client payment page links to Stripe’s hosted checkout. Stripe loads when you follow a payment link. The model catalogue is refreshed during publishing, so browsing it does not send your visit to a model provider.
Read the privacy policyReport a security issue
Email the affected URL, what you observed and enough detail to help reproduce the issue. Please avoid including personal data or secret keys.
security@khadaffi.comKeep reports private while the issue is investigated. Acknowledge the limits of your access and avoid interrupting anyone’s service.