Built something with AI?

Let’s make sure it’s
safe to run.

You’ve built a tool that works.
Let’s keep it that way.

Before your team, your customers or your data depend on it, let’s work out where the risks are and the simplest ways to reduce them.

Tell me what you’ve built How I approach it

Sound familiar?

It works, but you’re not quite sure what’s exposed.
There’s an API key somewhere in the code. Probably.
It’s on a public link, and you don’t know who else can reach it.
You asked the AI if it’s secure. It said yes.
Your team wants to start using it, and you want to get it right first.

That’s normal. Building it was the hard part. Running it safely is the part people skip.

Not an audit.
A conversation about doing it properly.

I’m not here to hand you a long list of everything that’s wrong. I’ll look at what you’ve built, how you plan to use it and what it touches. Then we’ll work out together what’s worth changing.

Some things matter a lot. Some barely matter at all. The goal isn’t perfect. It’s sensible.

How it usually goes

Understand what you’ve built.
What does it do, who uses it, and what data does it touch?
Find the real risks.
Not every theoretical problem. Just the ones that could actually hurt you.
Make the simplest fixes.
Often that means changing how it runs, not rewriting what you’ve built.
Know what’s left.
You’ll understand what we’ve reduced and what still needs care, so nothing is assumed.

What we’ll usually look at.

Where it runs: Is it isolated from everything else, or sharing a home with things it shouldn’t?
Who can reach it: Does it really need to be on the public internet? Often a private connection is simpler and much safer.
Who can do what: Logins, permissions and admin access, so people and systems only have the access they need.
Keys and secrets: Passwords, API keys and tokens kept out of the code and out of sight.
Your data: What it stores, where it goes and who can see it.
When things go wrong: Backups, updates and a plan for when something breaks.
The code itself: Automated checks and an experienced second look for common mistakes, including ones the AI introduced.

Honest about the limits.

AI-assisted reviews and automated scans are useful. They catch real problems. But they aren’t proof that something is secure, and neither is any single review.

What you’ll get is a setup with meaningfully less risk, and a clear picture of what still needs attention. If you need a formal penetration test for compliance or a client, I’ll tell you, and help you work out what to ask for.

Security is what I do.

I work in cybersecurity, and I have for most of my career: infrastructure, SOC operations, and investigating how systems fail. Alongside that, I build websites, software and automations, and I run my own servers at home.

That combination is the point. I know how these tools get built, and I see every day how things go wrong.