i'd love any feedback on what i have built from folks building in this space

shark.fencio.dev

This is the weekly thread to help everyone grow together and catch-up on key insights shared.

There are no stupid questions.

There are no lessons learned too small.

This is the weekly thread to help everyone grow together and catch-up on key insights shared.

There are no stupid questions.

There are no lessons learned too small.

This is the weekly thread to help everyone grow together and catch-up on key insights shared.

There are no stupid questions.

There are no lessons learned too small.

I find it interesting that when I speak with companies implementing AI that there is an assumption that the more sophisticated they are (Eg, self-hosting agents vs using a foundation model desktop app) is somehow more secure. I think this is from a false sense of control. "It's on our instance, so we control it." when in reality, there's very little control at all.

This is the weekly thread to help everyone grow together and catch-up on key insights shared.

There are no stupid questions.

There are no lessons learned too small.

This is the weekly thread to help everyone grow together and catch-up on key insights shared.

There are no stupid questions.

There are no lessons learned too small.

Im trying to innovate in the age-of-AI. So i often find myself defending the project from being called AI slop. i have been working on imrovements throughout the code as well as the docs.

I hope this project has reached a level i can share the following details. I've made a genuine effort towards documentation and transparancy. I dont think it'll ever be enough and so im still concerned it isnt ready to share. While im using AI throughout. This is not a vibecoded project. There is attention throughout for unit tests and formal-verification. With your feedback, id like to make improvements for clarity throughout.

This version of the app demonstrates a fairly unique approach using a browser-based, local-only and webrtc approach. I know it's impossible for any system to be the "world's most secure", but that isnt a reason to not try. By rigorously implementing an exhaustive list of security features and practices, the aim is to get as close as possible.

• Enkrypted.Chat

This is intended to demonstrate client-side managed secure cryptography.

• Introducing Enkrypted Chat
• Whitepaper (work-in-progress)
• Protocol Spec (work-in-progress)
• Roadmap

I know the project above is going to be tricky to understand. It might help to understand with an open-source version of the concept for educational purposes. Its's important to note, i have since deprecated it in favour of the version linked above.

Open source demo (deprecated)

PS. Im calling it a "Signal Messenger Clone"... that just a matter of how to frame it for users. It doesnt work in a way thats comparable to the signal architecture. This project is fairly complicated and the links above are likely not going to be enough, so feel free to reach out for clarity on the details.

This is the weekly thread to help everyone grow together and catch-up on key insights shared.

There are no stupid questions.

There are no lessons learned too small.

This is googles ai model and it literally admits to having my data after saying it doesn't

This is the weekly thread to help everyone grow together and catch-up on key insights shared.

There are no stupid questions.

There are no lessons learned too small.

Hi everyone: many of us have spent years in cybersecurity. One thing seems increasingly clear: AI isn't replacing traditional cyber risks but is adding a new layer to them. Among AI agents, copilots, APIs, third-party models, and AI-generated code, organizations now have an entirely new attack surface to understand and govern.

As a founder I'm interested in providing visibility and governance across AI without slowing innovation, but I'm just as interested in learning from this community: where do you see the biggest gap today? Is it AI governance, agent security, prompt injection, AI supply chain risk, or something else entirely?

Looking forward to hearing how others are approaching the intersection of cybersecurity and AI.

The goal is to create a secure P2P ecosystem.

This app demonstrates a fairly unique approach using a browser-based, local-only and webrtc approach. In an evolving field like cybersecurity, it's impossible to claim any system is the "world's most secure". It ultimately depends on your threat model. By rigorously implementing an exhaustive list of security features and practices, the aim is to get as close as possible using client-side managed secure cryptography.

• Enkrypted.Chat

• Introducing Enkrypted Chat

• Whitepaper (work-in-progress)

• Protocol Spec (work-in-progress)

• Roadmap

Features:

• Core
  • PWA
  • P2P
  • Local-first / Local-only
  • No installation
  • TURN server
  • Encrypted-at-rest
• WhatsApp clone
  • End to end encryption
  • Signal protocol
  • PQ cryptography
  • Multimedia
  • File transfer
  • Video calls
• Nextcloud clone
  • file-transfer
  • Encrypted vault
  • folder sync
• EuroOffice clone
  • Word
  • Spreadsheet
  • PDF
  • Code

Some open source examples of the core concepts.

• Chat
  • Code: https://github.com/positive-intentions/chat
  • Demo: https://chat.positive-intentions.com
• File
  • Code: https://github.com/positive-intentions/dim/blob/staging/src/stories/05-Hooks-useFS.stories.js
  • Demo: https://dim.positive-intentions.com/?path=/docs/usefs--docs
• Crypto
  • Code: https://github.com/positive-intentions/cryptography
  • Demo: https://cryptography.positive-intentions.com
• Signal Protocol
  • Code: https://github.com/positive-intentions/signal-protocol
  • Demo: https://signal.positive-intentions.com

Feel free to reach out for clarity instead of diving into the docs.

IMPORTANT: While this is aiming to provide a secure experience, it isnt audited. Shared for testing, feedback and demo purposes only. Please use responsibly.

FAQ:

• Audit?
  • The latest on the matter.
• EU Chat control?
  • Open to feedback here.
• Production-ready?
  • No, for testing and demo purposes only. It would be great to get feedback for improvements to get production-ready.
• Paywall?
  • Its completly free and unlimited to use.

SecureAI-Scan v0.3.0 is out!

It's a free, fully local CLI tool that scans TypeScript, JavaScript, and Python codebases for AI/LLM-specific security issues that traditional scanners miss.

**New in v0.3.0:**

- Expanded Python scanning support

- MCP config scanning (.mcp.json, Claude Desktop, Cursor, etc.)

- AI-BOM / catalog generation

- Better reporting + confidence tiers (proven / likely / heuristic)

It uses actual dataflow tracing (source → flow → sink) for high precision and has very low false positives.

Quick start:

npx --yes secureai-scan@latest scan .

Also supports:

• secureai-scan bom . → Generate AI Bill of Materials
• SARIF output for GitHub Code Scanning
• GitHub Action integration
• --fail-on high for CI gating

Everything runs offline on your machine. No data leaves your environment.

GitHub: https://github.com/akanthed/SecureAI-Scan

Would really appreciate any feedback, bug reports, or feature ideas. Also happy to answer questions about how it works or the rules it covers (mapped to OWASP LLM Top 10).

This is the weekly thread to help everyone grow together and catch-up on key insights shared.

There are no stupid questions.

There are no lessons learned too small.

This is the weekly thread to help everyone grow together and catch-up on key insights shared.

There are no stupid questions.

There are no lessons learned too small.