The developer guide
Ship your AI product safely
The guide for teams with no security team.
Five stages
- 1 hour
The one-hour baseline
Start with the controls you can check before an AI feature reaches users: server-side keys, spend limits, prompt secrets and agent config.
- Half a day
Before your first users
Before real users arrive, check the boundary between model text and your tools: validate arguments, enforce permissions and require approval.
- 1–2 days
Before your first paying customer
Before customers depend on your AI, test tenant boundaries, memory, deletion, trace redaction and regressions in the behavior you rely on.
- 1 week
Before your first enterprise deal
Map your AI feature's data, untrusted inputs, available actions and approval boundaries so a buyer can inspect what you actually enforce.
- Ongoing
Running it
Keep the same test pack across model and prompt changes, and rehearse how to stop tool actions, rotate keys and investigate an incident.
What are you building?
An agent that remembers
Control how agent memory is written, labeled, inspected and deleted, and test that outside instructions and sensitive trace values do not persist.
A chatbot or support assistant
Secure a chatbot's provider keys, request limits, prompt content and output rendering, then test its job boundary and trace redaction.
Working with Claude Code, Cursor or Codex
Review the files and extensions that grant a coding agent access, keep provider keys off clients and require approval before irreversible actions.
An LLM judge or eval pipeline
Keep candidate text out of the rubric, parse judge decisions strictly and compare the same evaluation cases when the model or prompt changes.
Running open-weight models yourself
Inspect an open-weight model and its template before inference, review extensions, lock approved artifacts and repeat tests when the model changes.
Building or installing an MCP server
Review the source and access of an MCP server, validate tool arguments, preserve user permissions and check the configuration that launches it.
RAG over your customers' data
Keep retrieved customer data tenant-scoped and untrusted, render answers safely and verify that deletion and injection regression tests reach retrieval.
An agent that calls tools
Validate and authorize model-requested actions, bind approvals to exact arguments and test tool traces under untrusted input and bounded request work.
Know the limit
A checklist does not prove your product is safe. Test each control against your own tools, data and permissions, and read the limits on each page.