I built a small internal-style tool and intentionally left it vulnerable to understand how these issues chain together.

After hardening it (including using an LLM), I realized removing the obvious exploits didn’t actually make the system secure.

This write-up is the first in a series that I'm working on. It’s less about “how to do it right” and more an exploration of where that boundary between safer and secure actually is.

I’ve been thinking about how AI-assisted development intersects with security.